Lucene search
RootSSV:20381HistoryMar 18, 2011 - 12:00 a.m.
PHP "substr_replace()"释放后重用远程内存破坏漏洞
2011-03-1800:00:00
Root
www.seebug.org
35
0.016 Low
EPSS
Percentile
85.9%
BUGTRAQ ID: 46843
CVE ID: CVE-2011-1148
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。
PHP的"substr_replace()"函数在实现上存在释放后重用远程内存破坏漏洞，远程攻击者可利用此漏洞在网络服务器中执行任意代码，造成拒绝服务。
此漏洞源于在将同一个变量多次发送到"substr_replace()"函数时，PHP会使该函数中的三个变量使用同一个指针，所以当函数中的类型转换更改了该指针，该指针也会使其他变量无效。
PHP PHP 5.3.x
PHP PHP 5.2.x
厂商补丁：
PHP
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
Related
veracode
veracode
Arbitrary Code Execution
2020-04-10 01:03:24
prion
prion
Design/Logic Flaw
2011-03-18 15:55:00
cve
cve
CVE-2011-1148
2011-03-18 15:55:00
ubuntucve
ubuntucve
CVE-2011-1148
2011-03-18 00:00:00
openvas
openvas
PHP 'substr_replace()' Use After Free Vulnerability
2011-03-22 00:00:00
Slackware Advisory SSA:2011-237-01 php
2012-09-10 00:00:00
FreeBSD Ports: php5, php5-sockets
2011-09-21 00:00:00
f5
f5
K15441 : PHP vulnerability CVE-2011-1148
2014-08-07 00:00:00
SOL15441 - PHP vulnerability CVE-2011-1148
2014-08-07 00:00:00
nessus
nessus
Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : php (SSA:2011-237-01)
2011-08-26 00:00:00
PHP 5.3 < 5.3.7 Multiple Vulnerabilities
2011-08-23 00:00:00
securityvulns
securityvulns
[slackware-security] php (SSA:2011-237-01)
2011-08-27 00:00:00
PHP multiple security vulnerabilities
2011-08-27 00:00:00
[USN-1126-1] PHP vulnerabilities
2011-05-01 00:00:00
freebsd
freebsd
php -- multiple vulnerabilities
2011-08-18 00:00:00
slackware
slackware
[slackware-security] php
2011-08-25 16:35:35
fedora
fedora
[SECURITY] Fedora 15 Update: php-eaccelerator-0.9.6.1-9.fc15
2011-09-18 23:00:38
[SECURITY] Fedora 16 Update: php-eaccelerator-0.9.6.1-9.fc16
2011-09-09 17:13:35
[SECURITY] Fedora 14 Update: maniadrive-1.2-32.fc14
2011-09-18 22:59:22
amazon
amazon
Important: php
2011-10-11 00:07:00
redhat
redhat
(RHSA-2012:0033) Moderate: php security update
2012-01-18 00:00:00
(RHSA-2011:1423) Moderate: php53 and php security update
2011-11-02 00:00:00
oraclelinux
oraclelinux
php security update
2012-01-18 00:00:00
php53 and php security update
2011-11-02 00:00:00
php security update
2012-06-29 00:00:00
centos
centos
php security update
2012-01-18 19:55:58
php53 security update
2011-11-03 03:59:22
osv
osv
php5 - several
2012-02-13 00:00:00
debian
debian
[SECURITY] [DSA 2408-1] php5 security update
2012-02-13 18:15:24
ubuntu
ubuntu
PHP vulnerabilities
2011-04-29 00:00:00
PHP Regressions
2011-05-05 00:00:00
gentoo
gentoo
PHP: Multiple vulnerabilities
2011-10-10 00:00:00