CVE-2012-2688

Vulnerabilidad no especificada,relacionado con un "desbordamiento", en la función _php_stream_scandir en la implementación de los flujos (streams) en PHP antes de v5.3.15 y v5.4.x antes de v5.4.5 tiene un impacto desconocido y vectores de ataque a remotos.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that PHP did not check for carriage returns in HTTP headers, allowing intended HTTP response splitting protections to be bypassed. Depending on the web browser the victim is using, a remote attacker could use this flaw to perform HTTP response splitting attacks. An integer signedness issue, leading to a heap-based buffer underflow, was found in the PHP scandir() function. If a remote attacker could upload an excessively large number of files to a directory the scandir() function runs on, it could cause the PHP interpreter to crash or, possibly, execute arbitrary code.