CVE-2013-6420

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1)…

published December 17, 2013

CVSS
—
EPSS
36%
Percentile
98.5
In the wild
Unconfirmed
What it is

The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.35635 · 98.5th percentile
Published
2013-12-17T02:00Z
EPSS history
Timeline
  • 17 DEC 02:00Z
    The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1)…
    cvelistv5