Back
CVE-2011-1657
The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers…
Medium5.0EPSS 5.1%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | Medium5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
- EPSS (exploitation in 30 days)
- 5.1% · top 7.6% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.
Weakness
Affected products
n/a
- affected n/a
References (14)
- [oss-security] 20110701 php ZipArchive::addGlob() crashes on invalid flags (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://bugs.php.net/bug.php?id=54681 (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://support.apple.com/kb/HT5130 (opens in a new tab)x_refsource_CONFIRMx_transferred
- MDVSA-2011:165 (opens in a new tab)vendor-advisoryx_refsource_MANDRIVAx_transferred
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?view=log (opens in a new tab)x_refsource_CONFIRMx_transferred
- APPLE-SA-2012-02-01-1 (opens in a new tab)vendor-advisoryx_refsource_APPLEx_transferred
- http://svn.php.net/viewvc/?view=revision&revision=310814 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 20110819 PHP 5.3.6 ZipArchive invalid use glob(3) (opens in a new tab)third-party-advisoryx_refsource_SREASONRESx_transferred
- 49252 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- [oss-security] 20110701 Re: php ZipArchive::addGlob() crashes on invalid flags (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [oss-security] 20110701 Re: Re: php ZipArchive::addGlob() crashes on invalid flags (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 8342 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
- 20110819 PHP 5.3.6 ZipArchive invalid use glob(3) (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- php-ziparchiveaddglob-dos(69320) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .