CVE-2013-6420

high · 7.5

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

7.5

CVSS

35.6%

EPSS (exploit prob.)

98th

EPSS percentile

2013-12-17

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
php	php	5.4.0
php	php	5.4.1
php	php	5.4.2
php	php	5.4.3
php	php	5.4.4
php	php	5.4.5
php	php	5.4.6
php	php	5.4.7
php	php	5.4.8
php	php	5.4.9
php	php	5.4.10
php	php	5.4.11
php	php	5.4.12
php	php	5.4.12
php	php	5.4.12
php	php	5.4.13
php	php	5.4.13
php	php	5.4.14
php	php	5.4.14
php	php	5.4.15
php	php	5.4.15
php	php	5.4.16
php	php	5.4.16
php	php	5.4.17
php	php	5.4.18
php	php	5.4.19
php	php	5.4.20
php	php	5.4.21
php	php	5.4.22
opensuse	opensuse	11.4
opensuse	opensuse	12.2
opensuse	opensuse	12.3
opensuse	opensuse	13.1
apple	mac_os_x	<= 10.9.1
php	php	<= 5.3.27
php	php	5.3.0
php	php	5.3.1
php	php	5.3.2
php	php	5.3.3
php	php	5.3.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-6420