CVE-2013-4248

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.18 PHP versions 5.5.x prior to 5.5.2

Description The issue arises from the improper handling of a '0' character in a domain name within the Subject Alternative Name field of an X.509 certificate by the openssl x509 parse function. This allows for man-in-the-middle attacks, where an attacker can spoof arbitrary SSL servers using a crafted certificate issued by a legitimate Certification Authority.

Recommendations For PHP versions prior to 5.4.18, update to version 5.4.18 or later. For PHP versions 5.5.x prior to 5.5.2, update to version 5.5.2 or later.