1. Home
  2. Vulnerabilities
  3. CVE-2012-1823
Known Exploited Vulnerability
9.8
CRITICAL CVSS 3.1
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability - [Actively Exploited]
Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

INFO

Published Date :

May 11, 2012, 10:15 a.m.

Last Modified :

Nov. 4, 2025, 6:15 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.

Required Action :

Apply updates per vendor instructions.

Notes :

https://nvd.nist.gov/vuln/detail/CVE-2012-1823

Affected Products

The following products are affected by CVE-2012-1823 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Redhat enterprise_linux_desktop
2 Redhat enterprise_linux_server
3 Redhat enterprise_linux_workstation
4 Redhat enterprise_linux_server_aus
5 Redhat enterprise_linux_eus
6 Redhat storage
7 Redhat storage_for_public_cloud
8 Redhat gluster_storage_server_for_on-premise
9 Redhat application_stack
1 Suse linux_enterprise_server
2 Suse linux_enterprise_software_development_kit
1 Fedoraproject fedora
1 Debian debian_linux
1 Hp hp-ux
1 Apple mac_os_x
1 Php php
1 Opensuse opensuse
: Total Affected Vendor : 8 | Products : 17
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 2.0 HIGH [email protected]
CVSS 3.1 CRITICAL [email protected]
CVSS 3.1 CRITICAL 134c704f-9b21-4f2e-91b3-4a467353bcc0
Solution
Update PHP and related software to the latest versions to fix vulnerabilities.
  • Update PHP to the latest available version.
  • Apply vendor security patches and updates.
  • Upgrade operating system or control panel software.
Public PoC/Exploit Available at Github

CVE-2012-1823 has a 75 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2012-1823.

URL Resource
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ Broken Link Exploit
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 Broken Link
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html Mailing List Third Party Advisory
http://marc.info/?l=bugtraq&m=134012830914727&w=2 Mailing List
http://rhn.redhat.com/errata/RHSA-2012-0546.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0547.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0568.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0569.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0570.html Third Party Advisory
http://secunia.com/advisories/49014 Broken Link
http://secunia.com/advisories/49065 Broken Link
http://secunia.com/advisories/49085 Broken Link
http://secunia.com/advisories/49087 Broken Link
http://support.apple.com/kb/HT5501 Third Party Advisory
http://www.debian.org/security/2012/dsa-2465 Third Party Advisory
http://www.kb.cert.org/vuls/id/520827 Exploit Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/673343 Third Party Advisory US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 Broken Link
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing List
http://www.php.net/ChangeLog-5.php#5.4.2 Exploit Patch Release Notes
http://www.php.net/archive/2012.php#id2012-05-03-1 Release Notes
http://www.securitytracker.com/id?1027022 Broken Link Third Party Advisory VDB Entry
https://bugs.php.net/bug.php?id=61910 Exploit Patch
https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ Mailing List Release Notes
http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ Broken Link Exploit
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 Broken Link
http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html Mailing List Third Party Advisory
http://marc.info/?l=bugtraq&m=134012830914727&w=2 Mailing List
http://rhn.redhat.com/errata/RHSA-2012-0546.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0547.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0568.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0569.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2012-0570.html Third Party Advisory
http://secunia.com/advisories/49014 Broken Link
http://secunia.com/advisories/49065 Broken Link
http://secunia.com/advisories/49085 Broken Link
http://secunia.com/advisories/49087 Broken Link
http://support.apple.com/kb/HT5501 Third Party Advisory
http://www.debian.org/security/2012/dsa-2465 Third Party Advisory
http://www.kb.cert.org/vuls/id/520827 Exploit Third Party Advisory US Government Resource
http://www.kb.cert.org/vuls/id/673343 Third Party Advisory US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 Broken Link
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing List
http://www.php.net/ChangeLog-5.php#5.4.2 Exploit Patch Release Notes
http://www.php.net/archive/2012.php#id2012-05-03-1 Release Notes
http://www.securitytracker.com/id?1027022 Broken Link Third Party Advisory VDB Entry
https://bugs.php.net/bug.php?id=61910 Exploit Patch
https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 Patch
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ Mailing List Release Notes
https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2012-1823 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2012-1823 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
Jaybest01/Web-Application-Vulnerability-Scan-Using-OWASP-ZAP-DVWA-

The objective of this lab was to perform a full automated web application vulnerability scan using OWASP ZAP, analyze discovered vulnerabilities, and document findings with remediation recommendations in alignment with the OWASP Top 10.

Updated: 1 day, 6 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 3, 2026, 7:20 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
waburig/Open-Worldwide-Application-Security-Project-OWASP-

Automated Web Vulnerability Assessment of DVWA using OWASP ZAP to identify and analyze critical security flaws like Remote Code Execution (CVE-2012-1823).

Updated: 2 days, 9 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 2, 2026, 5:33 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
SagwaM/OWASP_Web_Security_Testing

None

Updated: 2 days, 18 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 2, 2026, 8:39 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
harelod/Web-App-Vunerability-Scan-Using-OWASP-ZAP

This documentation focus on how OWASP ZAP can be used to scan a web application to identify vulnerablity and related remediation that can be applied.

Updated: 3 days, 3 hours ago
0 stars 0 fork 0 watcher
Born at : Jan. 1, 2026, 9:01 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
rayngnpc/CVE-2024-4577-rayng

CVE-2024-4577 PHP CGI Argument Injection - Detection Lab with Vagrant VMs and Wazuh SIEM rules

Updated: 5 days, 9 hours ago
0 stars 0 fork 0 watcher
Born at : Dec. 30, 2025, 5:49 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
eitcysec/dvwa-owasp-zap-lab

This project documents a full web application vulnerability assessment conducted on Damn Vulnerable Web Application (DVWA) using OWASP ZAP

Updated: 6 days, 14 hours ago
0 stars 0 fork 0 watcher
Born at : Dec. 29, 2025, 11:24 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
Alphin619/Nessus---Web-Application-Test

None

Updated: 6 days, 11 hours ago
0 stars 0 fork 0 watcher
Born at : Dec. 28, 2025, 5:20 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
nulltrace1336/PHP-CGI-Argument-Injection-Exploit

Ushbu videoda Kali Linux orqali Metasploitable 2 serveriga PHP CGI Argument Injection (CVE-2012-1823) ekspluatatsiyasi Metasploit yordamida amalga oshiriladi

Updated: 1 week, 5 days ago
0 stars 0 fork 0 watcher
Born at : Dec. 24, 2025, 12:18 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
VlntnLnhrdt/Bachelors-Thesis-Searching-Patterns-in-Simulated-Network-Attacks

Modular test framework for simulating and reproducing network attacks on web services. It supports interchangeable targets and penetration-testing tools, captures traffic, analyzes patterns, and automatically visualizes network activity for research and educational purposes.

Python Dockerfile Shell PHP HTML

Updated: 1 month, 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Nov. 6, 2025, 3:38 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
gehanfathy/Metasploitable-project-pentest

Vunlerability assisment

HTML

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 19, 2025, 12:18 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
Mohamed-Ashmawyy/Metasploitable2-Pentest-Project

Vulnerability assessment and penetration testing project for Metasploitable2 VM using Kali Linux tools

HTML

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Oct. 18, 2025, 11:53 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
fotisnanossec/Vuln-Report-AI

AI-enhanced vulnerability assessment platform that transforms raw security scan data into executive-ready intelligence reports. Integrates Nmap, Nuclei, and SQLMap with LLM analysis for enterprise security operations.

Python Shell

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 11, 2025, 8:28 p.m. This repo has been linked 2 different CVEs too.
Profile Photo
tourvan/penetration-testing-report

Penetration Testing Report covering Metasploitable2 and Windows Server 2008 vulnerabilities (EternalBlue, Samba, PHP-CGI, ProFTPD, etc.).

Updated: 4 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2025, 3:54 p.m. This repo has been linked 4 different CVEs too.
Profile Photo
fotisnanossec/Vuln-Report-AI

An automated tool that integrates open-source security scanners with a local LLM to produce structured security reports from raw scan data.

Python Shell

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 30, 2025, 10:45 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
Fkmanny/web-app-nessus-vulnerability-assessment

Nessus Vulnerability Assessment

Updated: 4 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 20, 2025, 10:24 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2012-1823 vulnerability anywhere in the article.

  • Daily CyberSecurity
Coordinated Cryptojacking Blitz: Hackers Exploit ThinkPHP and PHP RCE Flaws to Maximize Mining Profit

Analysts at GreyNoise Intelligence have reported a sharp, coordinated surge in attacks exploiting vulnerabilities across PHP and its frameworks—including ThinkPHP, PHPUnit, and the recently disclosed ... Read more

Published Date: Nov 05, 2025 (2 months ago)
  • Daily CyberSecurity
Morte Botnet Unveiled: A Rapidly Growing Loader-as-a-Service Campaign Exploiting Routers and Enterprise Apps

Researchers at CloudSEK Threat Intelligence (TRIAD) have exposed a sophisticated botnet operation that systematically compromises SOHO routers, IoT devices, and enterprise applications through web-bas ... Read more

Published Date: Sep 29, 2025 (3 months, 1 week ago)
  • CybersecurityNews
New Botnet Loader-as-a-Service Exploiting Routers and IoT Devices to Deploy Mirai Payloads

A sophisticated botnet operation has emerged, employing a Loader-as-a-Service model to systematically weaponize internet-connected devices across the globe. The campaign exploits SOHO routers, IoT dev ... Read more

Published Date: Sep 27, 2025 (3 months, 1 week ago)
  • BleepingComputer
Hackers use PHP exploit to backdoor Windows systems with new malware

Unknown attackers have deployed a newly discovered backdoor dubbed Msupedge on a university's Windows systems in Taiwan, likely by exploiting a recently patched PHP remote code execution vulnerability ... Read more

Published Date: Aug 20, 2024 (1 year, 4 months ago)
  • New Jetpack Site
Vulnerabilità critica in PHP sfruttata in the wild

PROTO: N240619 CERT-Yoroi informa che è stata resa nota una vulnerabilità critica sul linguaggio di programmazione PHP che consente ad utenti malintenzionati di eseguire del codice da remoto arbitrari ... Read more

Published Date: Jun 19, 2024 (1 year, 6 months ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2012-1823 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 04, 2025

    Action Type Old Value New Value
    Added Reference https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 22, 2025

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 21, 2025

    Action Type Old Value New Value
    Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 21, 2025

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1823
  • Modified Analysis by [email protected]

    Feb. 19, 2025

    Action Type Old Value New Value
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Feb. 07, 2025

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CWE CWE-77
  • Modified Analysis by [email protected]

    Jan. 06, 2025

    Action Type Old Value New Value
    Added CWE NIST CWE-77
    Removed CWE NIST NVD-CWE-noinfo
  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
    Added Reference http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
    Added Reference http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
    Added Reference http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
    Added Reference http://marc.info/?l=bugtraq&m=134012830914727&w=2
    Added Reference http://marc.info/?l=bugtraq&m=134012830914727&w=2
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0546.html
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0547.html
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0568.html
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0569.html
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0570.html
    Added Reference http://secunia.com/advisories/49014
    Added Reference http://secunia.com/advisories/49065
    Added Reference http://secunia.com/advisories/49085
    Added Reference http://secunia.com/advisories/49087
    Added Reference http://support.apple.com/kb/HT5501
    Added Reference http://www.debian.org/security/2012/dsa-2465
    Added Reference http://www.kb.cert.org/vuls/id/520827
    Added Reference http://www.kb.cert.org/vuls/id/673343
    Added Reference http://www.mandriva.com/security/advisories?name=MDVSA-2012:068
    Added Reference http://www.openwall.com/lists/oss-security/2024/06/07/1
    Added Reference http://www.php.net/archive/2012.php#id2012-05-03-1
    Added Reference http://www.php.net/ChangeLog-5.php#5.4.2
    Added Reference http://www.securitytracker.com/id?1027022
    Added Reference https://bugs.php.net/bug.php?id=61910
    Added Reference https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
    Added Reference https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
  • Modified Analysis by [email protected]

    Jul. 16, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ Exploit http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ Broken Link, Exploit
    Changed Reference Type http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 No Types Assigned http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 Broken Link
    Changed Reference Type http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html No Types Assigned http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html Mailing List, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html Mailing List, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html Mailing List, Third Party Advisory
    Changed Reference Type http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html No Types Assigned http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html Mailing List, Third Party Advisory
    Changed Reference Type http://marc.info/?l=bugtraq&m=134012830914727&w=2 No Types Assigned http://marc.info/?l=bugtraq&m=134012830914727&w=2 Mailing List
    Changed Reference Type http://rhn.redhat.com/errata/RHSA-2012-0546.html No Types Assigned http://rhn.redhat.com/errata/RHSA-2012-0546.html Third Party Advisory
    Changed Reference Type http://rhn.redhat.com/errata/RHSA-2012-0547.html No Types Assigned http://rhn.redhat.com/errata/RHSA-2012-0547.html Third Party Advisory
    Changed Reference Type http://rhn.redhat.com/errata/RHSA-2012-0568.html No Types Assigned http://rhn.redhat.com/errata/RHSA-2012-0568.html Third Party Advisory
    Changed Reference Type http://rhn.redhat.com/errata/RHSA-2012-0569.html No Types Assigned http://rhn.redhat.com/errata/RHSA-2012-0569.html Third Party Advisory
    Changed Reference Type http://rhn.redhat.com/errata/RHSA-2012-0570.html No Types Assigned http://rhn.redhat.com/errata/RHSA-2012-0570.html Third Party Advisory
    Changed Reference Type http://secunia.com/advisories/49014 No Types Assigned http://secunia.com/advisories/49014 Broken Link
    Changed Reference Type http://secunia.com/advisories/49065 No Types Assigned http://secunia.com/advisories/49065 Broken Link
    Changed Reference Type http://secunia.com/advisories/49085 No Types Assigned http://secunia.com/advisories/49085 Broken Link
    Changed Reference Type http://secunia.com/advisories/49087 No Types Assigned http://secunia.com/advisories/49087 Broken Link
    Changed Reference Type http://support.apple.com/kb/HT5501 No Types Assigned http://support.apple.com/kb/HT5501 Third Party Advisory
    Changed Reference Type http://www.debian.org/security/2012/dsa-2465 No Types Assigned http://www.debian.org/security/2012/dsa-2465 Third Party Advisory
    Changed Reference Type http://www.kb.cert.org/vuls/id/520827 Exploit, US Government Resource http://www.kb.cert.org/vuls/id/520827 Exploit, Third Party Advisory, US Government Resource
    Changed Reference Type http://www.kb.cert.org/vuls/id/673343 US Government Resource http://www.kb.cert.org/vuls/id/673343 Third Party Advisory, US Government Resource
    Changed Reference Type http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 No Types Assigned http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 Broken Link
    Changed Reference Type http://www.openwall.com/lists/oss-security/2024/06/07/1 No Types Assigned http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing List
    Changed Reference Type http://www.php.net/archive/2012.php#id2012-05-03-1 No Types Assigned http://www.php.net/archive/2012.php#id2012-05-03-1 Release Notes
    Changed Reference Type http://www.php.net/ChangeLog-5.php#5.4.2 Exploit, Patch http://www.php.net/ChangeLog-5.php#5.4.2 Exploit, Patch, Release Notes
    Changed Reference Type http://www.securitytracker.com/id?1027022 No Types Assigned http://www.securitytracker.com/id?1027022 Broken Link, Third Party Advisory, VDB Entry
    Changed Reference Type https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 No Types Assigned https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 Patch
    Changed Reference Type https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ No Types Assigned https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ Mailing List, Release Notes
    Changed Reference Type https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ No Types Assigned https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ Mailing List, Release Notes
    Removed CWE NIST CWE-20
    Added CWE NIST NVD-CWE-noinfo
    Changed CPE Configuration OR *cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:beta1:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:beta2:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:beta3:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:beta4:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:rc1:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:rc2:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.0:rc3:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.2:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.3:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.4:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.5:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.6:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.7:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.8:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.9:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.10:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.11:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.12:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.13:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.14:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.15:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.16:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.2.17:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.0:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.1:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.2:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.3:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.4:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.5:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.6:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.7:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.8:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.9:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.3.10:*:*:*:*:*:*:* *cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to (including) 5.3.11 OR *cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions up to (excluding) 5.3.12 *cpe:2.3:a:php:php:*:*:*:*:*:*:*:* versions from (including) 5.4.0 up to (excluding) 5.4.2
    Changed CPE Configuration OR *cpe:2.3:a:php:php:5.4.0:*:*:*:*:*:*:* *cpe:2.3:a:php:php:5.4.1:*:*:*:*:*:*:* OR *cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* *cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:hp:hp-ux:b.11.23:*:*:*:*:*:*:* *cpe:2.3:o:hp:hp-ux:b.11.31:*:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* *cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* *cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:* *cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:* *cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:* *cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:* *cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*
    Added CPE Configuration OR *cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* versions from (including) 10.6.8 up to (excluding) 10.7.5 *cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* versions from (including) 10.8.0 up to (excluding) 10.8.2
    Added CPE Configuration OR *cpe:2.3:a:redhat:application_stack:2.0:*:*:*:*:*:*:* *cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:*:*:*:*:*:*:* *cpe:2.3:a:redhat:storage:2.0:*:*:*:*:*:*:* *cpe:2.3:a:redhat:storage_for_public_cloud:2.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:5.6:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:6.1:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_eus:6.2:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* *cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
  • CVE Modified by [email protected]

    Jun. 13, 2024

    Action Type Old Value New Value
    Added Reference CERT/CC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ [No types assigned]
  • CVE Modified by [email protected]

    Jun. 12, 2024

    Action Type Old Value New Value
    Added Reference CERT/CC https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ [No types assigned]
  • CVE Modified by [email protected]

    Jun. 10, 2024

    Action Type Old Value New Value
    Added Reference CERT/CC http://www.openwall.com/lists/oss-security/2024/06/07/1 [No types assigned]
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    Jan. 18, 2018

    Action Type Old Value New Value
    Added Reference http://www.debian.org/security/2012/dsa-2465 [No Types Assigned]
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html [No Types Assigned]
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 05, 2018

    Action Type Old Value New Value
    Added Reference http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 [No Types Assigned]
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0570.html [No Types Assigned]
    Added Reference http://rhn.redhat.com/errata/RHSA-2012-0569.html [No Types Assigned]
    Added Reference http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html [No Types Assigned]
  • Initial Analysis by [email protected]

    May. 11, 2012

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact
Base CVSS Score: 7.5
Access Vector
Access Complexity
Authentication
Confidentiality Impact
Integrity Impact
Availability Impact
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

94.39 }} 0.04%

score

0.99967

percentile