Vulnerability Name:

CVE-2009-1271 (CCN-48969)

Assigned:2009-02-26
Published:2009-02-26
Updated:2018-10-03
Summary:The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2009-1271

Source: MISC
Type: UNKNOWN
http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15

Source: APPLE
Type: UNKNOWN
APPLE-SA-2009-09-10-2

Source: SUSE
Type: UNKNOWN
SUSE-SR:2009:012

Source: CCN
Type: RHSA-2009-0350
Moderate: php security update

Source: CCN
Type: SA34081
PHP Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
34770

Source: SECUNIA
Type: UNKNOWN
34830

Source: SECUNIA
Type: UNKNOWN
34933

Source: SECUNIA
Type: UNKNOWN
35003

Source: SECUNIA
Type: UNKNOWN
35007

Source: SECUNIA
Type: UNKNOWN
35306

Source: SECUNIA
Type: UNKNOWN
35685

Source: CCN
Type: SA36701
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
36701

Source: CCN
Type: Apple Web site
About Security Update 2009-005

Source: CONFIRM
Type: UNKNOWN
http://support.apple.com/kb/HT3865

Source: DEBIAN
Type: UNKNOWN
DSA-1775

Source: DEBIAN
Type: UNKNOWN
DSA-1789

Source: DEBIAN
Type: DSA-1775
php-json-ext -- denial of service

Source: DEBIAN
Type: DSA-1789
php5 -- several vulnerabilities

Source: CCN
Type: GLSA-201001-03
PHP: Multiple vulnerabilities

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:090

Source: MLIST
Type: UNKNOWN
[oss-security] 20090401 CVE request: PHP 5.2.9

Source: CCN
Type: OSVDB ID: 52486
PHP json_decode() Function Malformed String Handling Remote DoS

Source: CCN
Type: PHP Web site
PHP 5.2.9 Release Announcement

Source: CONFIRM
Type: Vendor Advisory
http://www.php.net/releases/5_2_9.php

Source: REDHAT
Type: UNKNOWN
RHSA-2009:0350

Source: CCN
Type: BID-33927
PHP 5.2.8 and Prior Versions Multiple Vulnerabilities

Source: CCN
Type: USN-761-1
PHP vulnerabilities

Source: CCN
Type: USN-761-2
PHP vulnerabilities

Source: UBUNTU
Type: UNKNOWN
USN-761-2

Source: XF
Type: UNKNOWN
php-jsondecode-dos(48969)

Source: UBUNTU
Type: UNKNOWN
USN-761-1

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-3768

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-3848

Source: SUSE
Type: SUSE-SR:2009:012
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:php:php:5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.4:*:windows:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.6:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.7:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.8:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:php:php:5.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.1:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.3:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.2:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.4:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.5:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.6:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.7:-:*:*:*:*:*:*
  • OR cpe:/a:php:php:5.2.8:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_application_stack:2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:8.04::lts:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.8:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20091271
    V
    		CVE-2009-1271
    2022-05-20
    oval:org.opensuse.security:def:31707
    P
    		Security update for postgresql10 (Important)
    2021-11-22
    oval:org.opensuse.security:def:31302
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-11-19
    oval:org.opensuse.security:def:31658
    P
    		Security update for the Linux Kernel (Important)
    2021-07-22
    oval:org.opensuse.security:def:31224
    P
    		Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:31210
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:42077
    P
    		Security update for curl (Moderate)
    2021-05-26
    oval:org.opensuse.security:def:31150
    P
    		Security update for xorg-x11-server (Important)
    2021-04-14
    oval:org.opensuse.security:def:31748
    P
    		Security update for openssl (Moderate)
    2021-03-24
    oval:org.opensuse.security:def:31746
    P
    		Security update for wavpack (Important)
    2021-03-24
    oval:org.opensuse.security:def:31359
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-03-17
    oval:org.opensuse.security:def:31356
    P
    		Security update for python (Moderate)
    2021-03-16
    oval:org.opensuse.security:def:35524
    P
    		apache2-mod_php5-5.2.6-50.24.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35670
    P
    		apache2-mod_php5-5.2.14-0.7.24.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:41931
    P
    		apache2-mod_php5-5.2.6-50.24.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25151
    P
    		Security update for file-roller (Low)
    2020-12-01
    oval:org.opensuse.security:def:25793
    P
    		Security update for icedtea-web (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25222
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:25851
    P
    		Security update for freerdp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31446
    P
    		Security update for popt
    2020-12-01
    oval:org.opensuse.security:def:32635
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31448
    P
    		Security update for postgresql-init (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26489
    P
    		Security update for php7-imagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25279
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25807
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25233
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25900
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:30992
    P
    		Security update for jakarta-taglibs-standard (Important)
    2020-12-01
    oval:org.opensuse.security:def:31602
    P
    		Security update for tomcat6
    2020-12-01
    oval:org.opensuse.security:def:31505
    P
    		Security update for python27 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26524
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25360
    P
    		Security update for xrdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:25997
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25297
    P
    		Security update for libX11 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25939
    P
    		Security update for gstreamer-0_10-plugins-base (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30993
    P
    		Security update for jasper
    2020-12-01
    oval:org.opensuse.security:def:31592
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25417
    P
    		Security update for postgresql, postgresql96, postgresql10 and postgresql12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26635
    P
    		quagga on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25425
    P
    		Security update for bluez (Important)
    2020-12-01
    oval:org.opensuse.security:def:25953
    P
    		Security update for gcc48 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31004
    P
    		Security update for java-1_6_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:31138
    P
    		Security update for lcms
    2020-12-01
    oval:org.opensuse.security:def:25501
    P
    		Security update for ghostscript (Important)
    2020-12-01
    oval:org.opensuse.security:def:26670
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25506
    P
    		Security update for openexr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31812
    P
    		Security update for apache2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31078
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31139
    P
    		Security update for less (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31804
    P
    		Security update for ant (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25075
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25652
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25563
    P
    		Security update for xrdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:32450
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:31768
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31853
    P
    		Security update for coreutils (Important)
    2020-12-01
    oval:org.opensuse.security:def:25076
    P
    		Security update for cpio (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25705
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25647
    P
    		Security update for freetype2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:32489
    P
    		apache2-mod_php5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31958
    P
    		Security update for gtk2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31892
    P
    		Security update for expat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25087
    P
    		Security update for strongswan (Important)
    2020-12-01
    oval:org.opensuse.security:def:25754
    P
    		Security update for flash-player (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25221
    P
    		Security update for sysstat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25798
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:32596
    P
    		postgresql on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31914
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:12644
    P
    		DSA-1775-1 php-json-ext -- denial of service
    2014-07-21
    oval:org.mitre.oval:def:13920
    P
    		USN-761-2 -- php5 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:13775
    P
    		USN-761-1 -- php5 vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:13696
    P
    		DSA-1789-1 php5 -- several
    2014-06-23
    oval:org.mitre.oval:def:8164
    P
    		DSA-1789 php5 -- several vulnerabilities
    2014-06-23
    oval:org.mitre.oval:def:8239
    P
    		DSA-1775 php-json-ext -- denial of service
    2014-06-23
    oval:org.debian:def:1789
    V
    		several vulnerabilities
    2009-05-04
    oval:org.debian:def:1775
    V
    		denial of service
    2009-04-20
    BACK
    php php 5.2.0
    php php 5.2.1
    php php 5.2.2
    php php 5.2.3
    php php 5.2.4
    php php 5.2.4
    php php 5.2.5
    php php 5.2.6
    php php 5.2.7
    php php 5.2.8
    php php 5.2.0
    php php 5.2.1
    php php 5.2.3
    php php 5.2.2
    php php 5.2.4
    php php 5.2.5
    php php 5.2.6
    php php 5.2.7
    php php 5.2.8
    gentoo linux *
    canonical ubuntu 6.06
    mandrakesoft mandrake linux 2008.0
    debian debian linux 4.0
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.1 x86_64
    redhat rhel application stack 2
    apple mac os x 10.5
    mandrakesoft mandrake linux 2008.1
    canonical ubuntu 8.04
    mandriva linux 2009.0
    mandriva linux 2009.0 -
    debian debian linux 5.0
    apple mac os x server 10.5.8