CVE-2012-2336

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.13 PHP versions 5.4.x prior to 5.4.3

Description The issue is related to the handling of query strings that lack an equals sign character in the sapi/cgi/cgi main.c component of PHP, when configured as a CGI script. This allows remote attackers to cause a denial of service by placing command-line options in the query string. The problem arises from an incomplete fix for a previous issue.

Recommendations For PHP versions prior to 5.3.13, update to version 5.3.13 or later. For PHP versions 5.4.x prior to 5.4.3, update to version 5.4.3 or later.