UpHeron
All vulnerabilities

Servers and applications

CVE-2010-2950

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists…

Severity
Medium 6.8
Published
28 Sept 2010
Last changed
16 Jun 2026
Added to UpHeron
14 Oct 2026
Exploit chance
5.7% in the next 30 daysHigher than 93% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Format string (CWE-134)
Attack
Over the network · No login needed
Attacker can
Read some data · Change some data · Slow it down
CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P
Sources
NVD

Description

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

From NVD.

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 5.3.0
  • Version 5.3.1
  • Version 5.3.2
  • Version 5.3.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2010-2950
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2010-2950