CVE-2011-4153: php Improper Input Validation
Vulnerability summary
CVE-2011-4153 is a medium (CVSS 5.0) Improper Input Validation vulnerability in php. EPSS estimates a 11.77% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 3 public exploits are recorded.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 3Timeline
- 18-01-2012PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.77%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 11.77% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
3 foundExploit Reference (archives.neohapsis.com)
Maturity: unknown
Exploit Reference (cxsecurity.com)
Maturity: unknown
PHP 5.3.8 - Multiple Vulnerabilities
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php1 product
- phpEOL5.3.8
1 vendor · 1 product
References
9 links- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041Vendor AdvisoryX Refsource HP