PHP 'ext/soap/php_xml.c' Incomplete Fix Multiple Arbitrary File Disclosure Vulnerabilities

Bugtraq ID:	62373
Class:	Input Validation Error
CVE:	CVE-2013-1824
Remote:	Yes
Local:	No
Published:	Mar 20 2013 12:00AM
Updated:	Sep 01 2014 12:33AM
Credit:	Vendor reported these issues.
Vulnerable:	PHP PHP 5.4.1 PHP PHP 5.3.13 PHP PHP 5.3.12 PHP PHP 5.3.1 PHP PHP 5.3 PHP PHP 5.3.11 PHP PHP 5.3.10 Gentoo Linux Apple Mac Os X Server 10.6.8
Not Vulnerable:

PHP 'ext/soap/php_xml.c' Incomplete Fix Multiple Arbitrary File Disclosure Vulnerabilities

PHP is prone to multiple arbitrary file-disclosure vulnerabilities because it fails to sanitize user-supplied input.

An authenticated attacker can exploit these vulnerabilities to view arbitrary files within the context of the affected application. Other attacks are also possible.

Note: These issues are the result of an incomplete fix for the issues described in BID 58766 (PHP 'ext/soap/php_xml.c' Multiple Arbitrary File Disclosure Vulnerabilities).

Versions prior to PHP 5.3.22 and 5.4.13 are vulnerable.

PHP 'ext/soap/php_xml.c' Incomplete Fix Multiple Arbitrary File Disclosure Vulnerabilities

Attackers can exploit these issues through a browser.

PHP 'ext/soap/php_xml.c' Incomplete Fix Multiple Arbitrary File Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PHP 'ext/soap/php_xml.c' Incomplete Fix Multiple Arbitrary File Disclosure Vulnerabilities

References:

• PHP Homepage (PHP)