$ cve CVE-2011-4153 JSON

CVE-2011-4153 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 11.8% (pctl 96)

Patch early

A public exploit exists.

Description

PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS	11.77% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2012-01-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
php	php

Public exploits

Source	Title	Date
exploit-db	PHP 5.3.8 - Multiple Vulnerabilities	2012-01-14

References

→ the Explorer · watch your stack · NVD