CVE-2011-4885

2011-12-2900:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.875 High

EPSS

Percentile

98.6%

JSON

PHP before 5.3.9 computes hash values for form parameters without
restricting the ability to trigger hash collisions predictably, which
allows remote attackers to cause a denial of service (CPU consumption) by
sending many crafted parameters.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/php5/+bug/910296>

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.22UNKNOWN
ubuntu10.04noarchphp5< 5.3.2-1ubuntu4.13UNKNOWN
ubuntu10.10noarchphp5< 5.3.3-1ubuntu9.9UNKNOWN
ubuntu11.04noarchphp5< 5.3.5-1ubuntu7.6UNKNOWN
ubuntu11.10noarchphp5< 5.3.6-13ubuntu3.5UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.22	UNKNOWN
ubuntu	10.04	noarch	php5	< 5.3.2-1ubuntu4.13	UNKNOWN
ubuntu	10.10	noarch	php5	< 5.3.3-1ubuntu9.9	UNKNOWN
ubuntu	11.04	noarch	php5	< 5.3.5-1ubuntu7.6	UNKNOWN
ubuntu	11.10	noarch	php5	< 5.3.6-13ubuntu3.5	UNKNOWN