CVE-2012-6113

NameCVE-2012-6113
DescriptionThe openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php5sourcesqueeze(not affected)
php5source(unstable)5.4.0~beta2-1

Notes

[squeeze] - php5 <not-affected> (Introduced in 5.3.9)
Introduced in https://git.php.net/?p=php-src.git;a=commitdiff;h=095cbc48a8f0090f3b0abc6155f2b61943c9eafb
Fixed in 5.3.14 https://git.php.net/?p=php-src.git;a=commitdiff;h=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e
https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1099793
https://bugs.php.net/bug.php?id=61413

Search for package or bug name: Reporting problems