CVE-2010-2950: php

Vulnerability summary

CVE-2010-2950 is a medium (CVSS 6.8) vulnerability in php. EPSS estimates a 5.69% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 28-09-2010
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

• CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.