Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 472204 (CVE-2013-3735) - <dev-lang/php-{5.4.17,5.3.27} : DoS (memory exhaustion, application crash) via crafted function definition (CVE-2013-3735)
Summary: <dev-lang/php-{5.4.17,5.3.27} : DoS (memory exhaustion, application crash) vi...
Alias: CVE-2013-3735
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
Whiteboard: A3 [glsa]
Depends on: CVE-2013-2110
  Show dependency tree
Reported: 2013-06-03 18:31 UTC by Agostino Sarubbo
Modified: 2014-08-31 11:25 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2013-06-03 18:31:06 UTC
From ${URL} :

Common Vulnerabilities and Exposures assigned an identifier CVE-2013-3735 to the following vulnerability:

** DISPUTED ** The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which 
allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as 
demonstrated by an attack within a shared web-hosting environment.  NOTE: the vendor's page says "for critical 
security situations you should be using OS-level security by running multiple web servers each as their own user id."


@maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
Comment 1 Ole Markus With (RETIRED) gentoo-dev 2013-06-07 12:18:11 UTC
Will be stabilised as part of bug 472558.
Removed the vulnerable rcs
Comment 2 Chris Reffett (RETIRED) gentoo-dev Security 2013-08-27 03:46:57 UTC
Added to GLSA request.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2014-08-31 10:49:04 UTC
This issue was resolved and addressed in
 GLSA 201408-11 at
by GLSA coordinator Kristian Fiskerstrand (K_F).
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2014-08-31 11:25:56 UTC
This issue was resolved and addressed in
 GLSA 201408-11 at
by GLSA coordinator Kristian Fiskerstrand (K_F).