CVE-2010-2950 Information disclosure in n/a
Attackers can exploit a format string flaw in the PHP phar extension to read memory or execute code via crafted URIs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-2950?
CVE-2010-2950 is a medium-severity vulnerability in Php Php, published on 28 Sep 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
Weakness: CWE-134
Which versions are affected by CVE-2010-2950?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2010-2950?
Upgrade to a fixed version.
Is CVE-2010-2950 being exploited?
There is no known exploitation of CVE-2010-2950 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-95f3-2wqm-398g.