CVE-2010-1861

2010-05-0723:00:00

CWE-399

[email protected]

web.nvd.nist.gov

cve

php

sysvshm

extension

vulnerability

memory addresses

nvd

6.8 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

59.6%

JSON

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object’s __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed resource.

CPENameOperatorVersion
php:phpphpeq5.2.9
php:phpphpeq5.2.2
php:phpphpeq5.2.5
php:phpphpeq5.2.12
php:phpphpeq5.2.11
php:phpphpeq5.2.6
php:phpphpeq5.2.3
php:phpphpeq5.2.13
php:phpphpeq5.2.0
php:phpphpeq5.2.4

CPE	Name	Operator	Version
php:php	php	eq	5.2.9
php:php	php	eq	5.2.2
php:php	php	eq	5.2.5
php:php	php	eq	5.2.12
php:php	php	eq	5.2.11
php:php	php	eq	5.2.6
php:php	php	eq	5.2.3
php:php	php	eq	5.2.13
php:php	php	eq	5.2.0
php:php	php	eq	5.2.4