A memory corruption flaw exists in PHP. The 'imap_do_open' function in the IMAP extension 'ext/imap/php_imap.c' fails to sanitize provided user credentials when opening the user mailbox folder resulting in memory corruption. With maliciously crafted user credentials, a local attacker can execute arbitrary code.
Classification
Location:
Local Access Required,
Local Access Required
Attack Type:
Denial of Service,
Input Manipulation
Impact:
Loss of Integrity,
Loss of Availability
Solution:
Upgrade
Exploit:
Exploit Unknown
Disclosure:
Vendor Verified
Solution
Upgrade to version 5.2.15, 5.3.4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
