CVE-2013-6712

The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted interval specification.

• CWE-119

• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=12fe4e90be7bfa2a763197079f68f5568a14e071
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
• http://www.debian.org/security/2013/dsa-2816Third Party Advisory
• http://www.ubuntu.com/usn/USN-2055-1Third Party Advisory
• https://bugs.php.net/bug.php?id=66060Issue Tracking, Patch, Vendor Advisory
• https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322Third Party Advisory
• https://support.apple.com/HT204659Third Party Advisory
• http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=12fe4e90be7bfa2a763197079f68f5568a14e071
• http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.htmlMailing List, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1765.htmlThird Party Advisory
• http://www.debian.org/security/2013/dsa-2816Third Party Advisory
• http://www.ubuntu.com/usn/USN-2055-1Third Party Advisory
• https://bugs.php.net/bug.php?id=66060Issue Tracking, Patch, Vendor Advisory
• https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322Third Party Advisory
• https://support.apple.com/HT204659Third Party Advisory

Published

Nov 28, 2013

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-6706The Cisco Express Forwarding processing module in Cisco IOS …
• CVE-2013-6707Memory leak in the connection-manager implementation in Cisc…
• CVE-2013-6708Cisco Cloud Portal 9.4 allows remote attackers to read files…
• CVE-2013-6709The registration component in Cisco WebEx Training Center pr…
• CVE-2013-6710Cross-site request forgery (CSRF) vulnerability in Cisco Web…
• CVE-2013-6711Cross-site scripting (XSS) vulnerability in the product-crea…
• CVE-2013-6713The Data Protection for VMware component in IBM Tivoli Stora…
• CVE-2013-6714The FlashCopy Manager for VMware component in IBM Tivoli Sto…
• CVE-2013-6716Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-6717The OLAP query engine in IBM DB2 and DB2 Connect 9.7 through…
• CVE-2013-6718The Advanced Management Module (AMM) with firmware 3.64B, 3.…
• CVE-2013-6719delivery.php in the Passive Capture Application (PCA) web co…