CVE-2012-6113: PHP

Medium severity, CVSS 5.0. EPSS: 2.5% chance of exploitation in the next 30 days.

The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.

Affected products

• PHP PHP: version 5.3.9 only; version 5.3.10 only; version 5.3.11 only; version 5.3.12 only; version 5.3.13 only

Published 2013-01-19. Last modified 2026-06-16.