CVE-2011-4885

Published: 29 December 2011

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885
• http://www.kb.cert.org/vuls/id/903934
• http://www.ocert.org/advisories/ocert-2011-003.html
• http://www.nruns.com/_downloads/advisory28122011.pdf
• https://ubuntu.com/security/notices/USN-1358-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/ubuntu/+source/php5/+bug/910296