CVE-2013-6420
Summary
| CVE | CVE-2013-6420 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2013-12-17 04:46:45 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function. |
Risk And Classification
Primary CVSS: v2.0 7.5 from [email protected]
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 0.356350000 probability, percentile 0.982880000 (date 2026-07-21)
Problem Types: CWE-119 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Apple | Mac Os X | All | All | All | All |
| Operating System | Opensuse | Opensuse | 11.4 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.2 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.3 | All | All | All |
| Operating System | Opensuse | Opensuse | 13.1 | All | All | All |
| Application | Php | Php | 5.3.0 | All | All | All |
| Application | Php | Php | 5.3.1 | All | All | All |
| Application | Php | Php | 5.3.10 | All | All | All |
| Application | Php | Php | 5.3.11 | All | All | All |
| Application | Php | Php | 5.3.12 | All | All | All |
| Application | Php | Php | 5.3.13 | All | All | All |
| Application | Php | Php | 5.3.14 | All | All | All |
| Application | Php | Php | 5.3.15 | All | All | All |
| Application | Php | Php | 5.3.16 | All | All | All |
| Application | Php | Php | 5.3.17 | All | All | All |
| Application | Php | Php | 5.3.18 | All | All | All |
| Application | Php | Php | 5.3.19 | All | All | All |
| Application | Php | Php | 5.3.2 | All | All | All |
| Application | Php | Php | 5.3.20 | All | All | All |
| Application | Php | Php | 5.3.21 | All | All | All |
| Application | Php | Php | 5.3.22 | All | All | All |
| Application | Php | Php | 5.3.23 | All | All | All |
| Application | Php | Php | 5.3.24 | All | All | All |
| Application | Php | Php | 5.3.25 | All | All | All |
| Application | Php | Php | 5.3.26 | All | All | All |
| Application | Php | Php | 5.3.3 | All | All | All |
| Application | Php | Php | 5.3.4 | All | All | All |
| Application | Php | Php | 5.3.5 | All | All | All |
| Application | Php | Php | 5.3.6 | All | All | All |
| Application | Php | Php | 5.3.7 | All | All | All |
| Application | Php | Php | 5.3.8 | All | All | All |
| Application | Php | Php | 5.3.9 | All | All | All |
| Application | Php | Php | 5.4.0 | All | All | All |
| Application | Php | Php | 5.4.1 | All | All | All |
| Application | Php | Php | 5.4.10 | All | All | All |
| Application | Php | Php | 5.4.11 | All | All | All |
| Application | Php | Php | 5.4.12 | All | All | All |
| Application | Php | Php | 5.4.12 | rc1 | All | All |
| Application | Php | Php | 5.4.12 | rc2 | All | All |
| Application | Php | Php | 5.4.13 | All | All | All |
| Application | Php | Php | 5.4.13 | rc1 | All | All |
| Application | Php | Php | 5.4.14 | All | All | All |
| Application | Php | Php | 5.4.14 | rc1 | All | All |
| Application | Php | Php | 5.4.15 | All | All | All |
| Application | Php | Php | 5.4.15 | rc1 | All | All |
| Application | Php | Php | 5.4.16 | All | All | All |
| Application | Php | Php | 5.4.16 | rc1 | All | All |
| Application | Php | Php | 5.4.17 | All | All | All |
| Application | Php | Php | 5.4.18 | All | All | All |
| Application | Php | Php | 5.4.19 | All | All | All |
| Application | Php | Php | 5.4.2 | All | All | All |
| Application | Php | Php | 5.4.20 | All | All | All |
| Application | Php | Php | 5.4.21 | All | All | All |
| Application | Php | Php | 5.4.22 | All | All | All |
| Application | Php | Php | 5.4.3 | All | All | All |
| Application | Php | Php | 5.4.4 | All | All | All |
| Application | Php | Php | 5.4.5 | All | All | All |
| Application | Php | Php | 5.4.6 | All | All | All |
| Application | Php | Php | 5.4.7 | All | All | All |
| Application | Php | Php | 5.4.8 | All | All | All |
| Application | Php | Php | 5.4.9 | All | All | All |
| Application | Php | Php | 5.5.0 | All | All | All |
| Application | Php | Php | 5.5.0 | alpha1 | All | All |
| Application | Php | Php | 5.5.0 | alpha2 | All | All |
| Application | Php | Php | 5.5.0 | alpha3 | All | All |
| Application | Php | Php | 5.5.0 | alpha4 | All | All |
| Application | Php | Php | 5.5.0 | alpha5 | All | All |
| Application | Php | Php | 5.5.0 | alpha6 | All | All |
| Application | Php | Php | 5.5.0 | beta1 | All | All |
| Application | Php | Php | 5.5.0 | beta2 | All | All |
| Application | Php | Php | 5.5.0 | beta3 | All | All |
| Application | Php | Php | 5.5.0 | beta4 | All | All |
| Application | Php | Php | 5.5.0 | rc1 | All | All |
| Application | Php | Php | 5.5.0 | rc2 | All | All |
| Application | Php | Php | 5.5.1 | All | All | All |
| Application | Php | Php | 5.5.2 | All | All | All |
| Application | Php | Php | 5.5.3 | All | All | All |
| Application | Php | Php | 5.5.4 | All | All | All |
| Application | Php | Php | 5.5.5 | All | All | All |
| Application | Php | Php | 5.5.6 | All | All | All |
| Application | Php | Php | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| openSUSE-SU-2013:1963-1: moderate: update for php5 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| openSUSE-SU-2013:1964-1: moderate: update for php5 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| USN-2055-1: PHP vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| About the security content of OS X Mavericks v10.9.2 and Security Update 2014-001 - Apple Support | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | |
| Debian -- Security Information -- DSA-2816-1 php5 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| PHP OpenSSL Memory Corruption Flaw in openssl_x509_parse() Lets Remote Users Execute Arbitrary Code - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| PHP: PHP 5 ChangeLog | af854a3a-2127-422b-91ae-364da2661108 | www.php.net | |
| PHP OpenSSL Extension 'openssl_x509_parse()' Remote Memory Corruption Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Bug 1036830 – CVE-2013-6420 php: memory corruption in openssl_x509_parse() | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Patch |
| Advisory 01/2013: PHP openssl_x509_parse() Memory Corruption Vulnerability | SektionEins GmbH | af854a3a-2127-422b-91ae-364da2661108 | www.sektioneins.de | Exploit |
| Security Advisory SA59652 - SUSE update for php5 - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| 208.43.231.11 Git - php-src.git/commit | af854a3a-2127-422b-91ae-364da2661108 | git.php.net | |
| Page Not Found - Interworx Forum | af854a3a-2127-422b-91ae-364da2661108 | forums.interworx.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| HP Support document - HP Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20564.www2.hp.com | |
| Interworx Forum | MITRE | forums.interworx.com | |
| 208.43.231.11 Git - php-src.git/commit | MITRE | git.php.net | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.