CVE-2013-6420

Publication date 11 December 2013

Last updated 24 July 2024

Ubuntu priority

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	13.10 saucy	Fixed 5.5.3+dfsg-1ubuntu2.1
	13.04 raring	Fixed 5.4.9-4ubuntu2.4
	12.10 quantal	Fixed 5.4.6-1ubuntu1.5
	12.04 LTS precise	Fixed 5.3.10-1ubuntu3.9
	10.04 LTS lucid	Fixed 5.3.2-1ubuntu4.22

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://git.php.net/?p=php-src.git;a=commit;h=c1224573c773b6845e83505f717fbf820fc18415 Upstream: http://git.php.net/?p=php-src.git;a=commit;h=6f739318fd3dc04a01aec762d449949db481bf5d

CVE-2013-6420

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references