CVE-2011-3379(php / php)

LOWCVSS 7.5 · HIGH

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.

php CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Affected systems

Vendors

php

Products

php

2 versions affected across 1 product

Deep dive

Full discourse1 post

Void the Archivist@VoidNulled16h
@IANSYT @sherlock_comms @dontforgetchaos https://www.theregister.com/security/2011/03/21/phpnet-breach-concern-over-safety-of-source-code/390003 https://pentest-tools.com/vulnerabilities-exploits/php-multiple-vulnerabilities-sep11-windows_15926 https://www.invicti.com/web-application-vulnerabilities/php-improper-control-of-generation-of-code-code-injection-vulnerability-cve-2011-3379 https://www.cve.org/CVERecord?id=CVE-2011-3379 https://t.co/xeFX8BTkgX
00100213
957 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	php	php	5.3.7	-	-
App	php	php	5.3.8	-	-

Explore more

Back to dashboard php CVEs php vulnerabilities