CVE-2013-4635

Publication date 21 June 2013

Last updated 24 July 2024

Ubuntu priority

Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	13.04 raring	Fixed 5.4.9-4ubuntu2.2
	12.10 quantal	Fixed 5.4.6-1ubuntu1.3
	12.04 LTS precise	Fixed 5.3.10-1ubuntu3.7
	10.04 LTS lucid	Fixed 5.3.2-1ubuntu4.20

Notes

seth-arnold

codesearch.debian.net shows no callers of this jdtojewish php function. Flaws in PHP itself that allow crashing the interpreter are not in themselves security problems.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://git.php.net/?p=php-src.git;a=commit;h=4828f7343b3f31d914f4d4a5545865b8a19f7fb6 Upstream: http://git.php.net/?p=php-src.git;a=commit;h=fc2a9d6e47ae23adb28122539b56df0d6195bdce

References

Related Ubuntu Security Notices (USN)