CVE-2011-0421

The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which…

published March 20, 2011

CVSS
—
EPSS
14%
Percentile
96.4
In the wild
Unconfirmed
What it is

The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.13514 · 96.4th percentile
Published
2011-03-20T01:00Z
EPSS history
Timeline
  • 20 MAR 01:00Z
    The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which…
    cvelistv5