CVE-2009-1271

php: crash on malformed input in json_decode()

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.

La función JSON_parser (ext/json/JSON_parser.c) en PHP v5.2.x anteriores a v5.2.9 permite a atacantes remotos provocar una denegación de servicio (falta de segmentación) a través de una cadena formada de forma incorrecta a la función API json_decode.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-04-08 CVE Reserved
2009-04-08 CVE Published
2024-08-05 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (24)

URL	Tag	Source
http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15	X_refsource_misc
http://secunia.com/advisories/34770	Third Party Advisory
http://secunia.com/advisories/34830	Third Party Advisory
http://secunia.com/advisories/34933	Third Party Advisory
http://secunia.com/advisories/35003	Third Party Advisory
http://secunia.com/advisories/35007	Third Party Advisory
http://secunia.com/advisories/35306	Third Party Advisory
http://secunia.com/advisories/35685	Third Party Advisory
http://secunia.com/advisories/36701	Third Party Advisory
http://support.apple.com/kb/HT3865	X_refsource_confirm
http://www.openwall.com/lists/oss-security/2009/04/01/9	Mailing List

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html	2018-10-03
http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html	2018-10-03
http://www.debian.org/security/2009/dsa-1775	2018-10-03
http://www.debian.org/security/2009/dsa-1789	2018-10-03
http://www.mandriva.com/security/advisories?name=MDVSA-2009:090	2018-10-03
http://www.php.net/releases/5_2_9.php	2018-10-03
http://www.redhat.com/support/errata/RHSA-2009-0350.html	2018-10-03
http://www.ubuntu.com/usn/USN-761-2	2018-10-03
https://usn.ubuntu.com/761-1	2018-10-03
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html	2018-10-03
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html	2018-10-03
https://access.redhat.com/security/cve/CVE-2009-1271	2009-04-14
https://bugzilla.redhat.com/show_bug.cgi?id=494530	2009-04-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.0 Search vendor "Php" for product "Php" and version "5.2.0"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.1 Search vendor "Php" for product "Php" and version "5.2.1"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.2 Search vendor "Php" for product "Php" and version "5.2.2"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.3 Search vendor "Php" for product "Php" and version "5.2.3"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.4 Search vendor "Php" for product "Php" and version "5.2.4"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.4 Search vendor "Php" for product "Php" and version "5.2.4"		windows		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.5 Search vendor "Php" for product "Php" and version "5.2.5"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.6 Search vendor "Php" for product "Php" and version "5.2.6"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.7 Search vendor "Php" for product "Php" and version "5.2.7"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				5.2.8 Search vendor "Php" for product "Php" and version "5.2.8"		-		Affected