CVE-2010-2950 in PHP
Summary
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
08/04/2010
Disclosure
09/28/2010
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 54852 | PHP Wrapper stream.c phar_stream_flush format string | 134 | Not defined | Not defined | CVE-2010-2950 |