CVE-2012-2386: php Numeric Errors
Vulnerability summary
CVE-2012-2386 is a high (CVSS 7.5) Numeric Errors vulnerability in php. EPSS estimates a 42.48% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 2 public exploits are recorded.
Public exploit (exploit-database, 22-04-2011)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2Timeline
- 07-07-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
42.48%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 42.48% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (0x1byte.blogspot.com)
Maturity: unknown
PHP 'phar' Extension 1.1.1 - Heap Overflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- php5< 5.3.3-7+squeeze13
Php1 product
- php≤ 5.3.13 | ≥ 5.4.0, < 5.4.4
2 vendors · 2 products
References
9 links- lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.apple.com/archives/security-announce/2012/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
- 0x1byte.blogspot.com/2011/04/php-phar-extension-heap-overflow.htmlX Refsource MISCExploitThird Party Advisory