CVE-2013-1643
Published: 6 March 2013
The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
upstream |
Released
(5.4.4-14)
|
| hardy |
Released
(5.2.4-2ubuntu5.27)
|
|
| lucid |
Released
(5.3.2-1ubuntu4.19)
|
|
| oneiric |
Released
(5.3.6-13ubuntu3.10)
|
|
| precise |
Released
(5.3.10-1ubuntu3.6)
|
|
| quantal |
Released
(5.4.6-1ubuntu1.2)
|
|
|
Patches: upstream: http://git.php.net/?p=php-src.git;a=commitdiff;h=c737b89473df9dba6742b8fc8fbf6d009bf05c36 upstream: http://git.php.net/?p=php-src.git;a=commit;h=8e76d0404b7f664ee6719fd98f0483f0ac4669d6 (5.4) vendor: http://www.debian.org/security/2013/dsa-2639 |
||