CVE-2010-1861 Use after free in n/a
Attackers can execute arbitrary code by exploiting a use-after-free vulnerability in the PHP sysvshm extension via crafted sleep functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-1861?
CVE-2010-1861 is a medium-severity use after free vulnerability in Php Php, published on 7 May 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed resource.
Weakness: CWE-399
Which versions are affected by CVE-2010-1861?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2010-1861?
No fix has been published for CVE-2010-1861 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2010-1861 being exploited?
There is no known exploitation of CVE-2010-1861 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-r9p4-q4p6-83c5.