CVE-2012-2386

[CVE catalog]

Severity

Unknown

Published

May 21, 2012, 12:00:00 AM UTC

Updated

Mar 9, 2026, 1:19:19 AM UTC

Source

[NVD] · [CVE record]

EPSS

42.48% · Oct 25, 2026

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow. php: Integer overflow leading to heap-buffer overflow in the Phar extension This issue did not affect the version of php as shipped with Red Hat Enterprise Linux 5 as it did not include support for phar extension yet. This issue was addressed in php53 package for Red Hat Enterprise Linux 5 via RHSA-2012:1047 and in php package for Red Hat Enterprise Linux 6 via RHSA-2012:1046. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.