CVE-2013-6420: apple mac_os_x

Modified

AliasesRHSA-2013:1813RHSA-2013:1815RHSA-2013:1824+2 more

Published 17-12-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-6420 is a high (CVSS 7.5) vulnerability in apple mac_os_x. EPSS estimates a 35.63% chance of exploitation in the next 30 days, higher than 98.4% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Prioritisepublic exploit

Public exploit (exploit-database, 17-12-2013)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

35.63%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 6 · Related 3

DSA-2816-1 MGASA-2013-0379 OPENSUSE-SU-2024:10290-1 OPENSUSE-SU-2024:10344-1 OPENSUSE-SU-2024:11169-1 RHSA-2013:1814

Timeline

17-12-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

35.63%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 35.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (sektioneins.de)
Maturity: unknown
exploit-databasedosphpUnverified
PHP - 'openssl_x509_parse()' Memory Corruption
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat79 products

php< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-bcmath< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-cli< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-common< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-dba< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1

php-debuginfo< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-devel< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-domxml< 0:4.3.9-3.37.el4.1
php-embedded< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-enchant< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-fpm< 0:5.3.3-27.el6_5 | < 0:5.3.3-23.el6_4.1
php-gd< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.9-3.37.el4.1
php-imap< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-intl< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-ldap< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-mbstring< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.9-3.37.el4.1
php-mysql< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-ncurses< 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:4.3.9-3.37.el4.1
php-odbc< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-pdo< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-pear< 0:4.3.9-3.37.el4.1
php-pgsql< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.2-57.ent | < 0:4.3.9-3.37.el4.1
php-process< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-pspell< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-recode< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-snmp< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.9-3.37.el4.1
php-soap< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-tidy< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-xml< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php-xmlrpc< 0:5.3.3-27.el6_5 | < 0:5.1.6-23.5.el5_3 | < 0:5.1.6-27.el5_6.6 | < 0:5.1.6-40.el5_9.1 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1 | < 0:4.3.9-3.37.el4.1
php-zts< 0:5.3.3-27.el6_5 | < 0:5.3.3-3.el6_2.11 | < 0:5.3.3-14.el6_3.3 | < 0:5.3.3-23.el6_4.1
php53< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-bcmath< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-cli< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-common< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-dba< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-debuginfo< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-devel< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-gd< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-imap< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-intl< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-ldap< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-mbstring< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-mysql< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-odbc< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-pdo< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-pgsql< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-process< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-pspell< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-snmp< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-soap< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-xml< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php53-xmlrpc< 0:5.3.3-22.el5_10 | < 0:5.3.3-1.el5_6.4 | < 0:5.3.3-13.el5_9.2
php54-php< 0:5.4.16-7.el6.1
php54-php-bcmath< 0:5.4.16-7.el6.1
php54-php-cli< 0:5.4.16-7.el6.1
php54-php-common< 0:5.4.16-7.el6.1
php54-php-dba< 0:5.4.16-7.el6.1
php54-php-debuginfo< 0:5.4.16-7.el6.1
php54-php-devel< 0:5.4.16-7.el6.1
php54-php-enchant< 0:5.4.16-7.el6.1
php54-php-fpm< 0:5.4.16-7.el6.1
php54-php-gd< 0:5.4.16-7.el6.1
php54-php-imap< 0:5.4.16-7.el6.1
php54-php-intl< 0:5.4.16-7.el6.1
php54-php-ldap< 0:5.4.16-7.el6.1
php54-php-mbstring< 0:5.4.16-7.el6.1
php54-php-mysqlnd< 0:5.4.16-7.el6.1
php54-php-odbc< 0:5.4.16-7.el6.1
php54-php-pdo< 0:5.4.16-7.el6.1
php54-php-pgsql< 0:5.4.16-7.el6.1
php54-php-process< 0:5.4.16-7.el6.1
php54-php-pspell< 0:5.4.16-7.el6.1
php54-php-recode< 0:5.4.16-7.el6.1
php54-php-snmp< 0:5.4.16-7.el6.1
php54-php-soap< 0:5.4.16-7.el6.1
php54-php-tidy< 0:5.4.16-7.el6.1
php54-php-xml< 0:5.4.16-7.el6.1
php54-php-xmlrpc< 0:5.4.16-7.el6.1

Show all 79

Apple1 product

mac_os_x≤ 10.9.1

Opensuse1 product

opensuseEOL11.4 | 12.2 | 12.3 | 13.1

Php1 product

phpEOL5.4.0 | 5.4.1 | 5.4.2 | 5.4.3 | 5.4.4 | 5.4.5 | 5.4.6 | 5.4.7 | 5.4.8 | 5.4.9 | 5.4.10 | 5.4.11 | 5.4.12 | 5.4.12:rc1 | 5.4.12:rc2 | 5.4.13 | 5.4.13:rc1 | 5.4.14 | 5.4.14:rc1 | 5.4.15 | 5.4.15:rc1 | 5.4.16 | 5.4.16:rc1 | 5.4.17 | 5.4.18 | 5.4.19 | 5.4.20 | 5.4.21 | 5.4.22 | ≤ 5.3.27 | 5.3.0 | 5.3.1 | 5.3.2 | 5.3.3 | 5.3.4 | 5.3.5 | 5.3.6 | 5.3.7 | 5.3.8 | 5.3.9 | 5.3.10 | 5.3.11 | 5.3.12 | 5.3.13 | 5.3.14 | 5.3.15 | 5.3.16 | 5.3.17 | 5.3.18 | 5.3.19 | 5.3.20 | 5.3.21 | 5.3.22 | 5.3.23 | 5.3.24 | 5.3.25 | 5.3.26 | 5.5.0 | 5.5.0:alpha1 | 5.5.0:alpha2 | 5.5.0:alpha3 | 5.5.0:alpha4 | 5.5.0:alpha5 | 5.5.0:alpha6 | 5.5.0:beta1 | 5.5.0:beta2 | 5.5.0:beta3 | 5.5.0:beta4 | 5.5.0:rc1 | 5.5.0:rc2 | 5.5.1 | 5.5.2 | 5.5.3 | 5.5.4 | 5.5.5 | 5.5.6

4 vendors · 82 products