{"id":"CVE-2013-4635","aliases":["EUVD-2013-4491","GHSA-mw77-m68p-3ffp","MGASA-2013-0172","MGASA-2013-0176","SUSE-SU-2015:0370-1","SUSE-SU-2015:0436-1","SUSE-SU-2015:1018-1","SUSE-SU-2015:1265-1"],"status":"published","title":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before...","description":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0423,"percentile":0.91072,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-189"],"published":"2013-06-18T15:00:10Z","modified":"2026-06-16T23:57:39Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.16-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"php-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.14-7.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"php-gd-bundled","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.16-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"php-timezonedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.3-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.26-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-apc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.13-1.8.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-eaccelerator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6.1-10.10.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-gd-bundled","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.26-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-timezonedb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.3-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-firebird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.26-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:2","package":"php-pdo_firebird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.26-1.mga2"}]}],"bundled":2}],"products":[{"vendor":"php","product":"php"}],"references":[{"url":"http://www.securitytracker.com/id/1028699","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://secunia.com/advisories/54104","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00007.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1905-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"]},{"url":"http://www.php.net/ChangeLog-5.php","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.attrition.org/pipermail/vim/2013-June/002697.html","tags":["mailing-list","x_refsource_VIM","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://bugs.php.net/bug.php?id=64895","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4635"},{"url":"https://github.com/advisories/GHSA-mw77-m68p-3ffp"},{"url":"https://advisories.mageia.org/MGASA-2013-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10456","tags":["report"]},{"url":"http://lwn.net/Vulnerabilities/559055/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2013-0176.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10492","tags":["report"]},{"url":"https://bugs.php.net/bug.php?id=64879","tags":["report"]},{"url":"http://lwn.net/Vulnerabilities/559055","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150370-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/828020","tags":["report"]},{"url":"https://bugzilla.suse.com/829207","tags":["report"]},{"url":"https://bugzilla.suse.com/837746","tags":["report"]},{"url":"https://bugzilla.suse.com/842676","tags":["report"]},{"url":"https://bugzilla.suse.com/853045","tags":["report"]},{"url":"https://bugzilla.suse.com/854880","tags":["report"]},{"url":"https://bugzilla.suse.com/868624","tags":["report"]},{"url":"https://bugzilla.suse.com/880904","tags":["report"]},{"url":"https://bugzilla.suse.com/880905","tags":["report"]},{"url":"https://bugzilla.suse.com/882992","tags":["report"]},{"url":"https://bugzilla.suse.com/884986","tags":["report"]},{"url":"https://bugzilla.suse.com/884987","tags":["report"]},{"url":"https://bugzilla.suse.com/884989","tags":["report"]},{"url":"https://bugzilla.suse.com/884990","tags":["report"]},{"url":"https://bugzilla.suse.com/884991","tags":["report"]},{"url":"https://bugzilla.suse.com/884992","tags":["report"]},{"url":"https://bugzilla.suse.com/885961","tags":["report"]},{"url":"https://bugzilla.suse.com/886059","tags":["report"]},{"url":"https://bugzilla.suse.com/886060","tags":["report"]},{"url":"https://bugzilla.suse.com/893849","tags":["report"]},{"url":"https://bugzilla.suse.com/893853","tags":["report"]},{"url":"https://bugzilla.suse.com/902357","tags":["report"]},{"url":"https://bugzilla.suse.com/902360","tags":["report"]},{"url":"https://bugzilla.suse.com/902368","tags":["report"]},{"url":"https://bugzilla.suse.com/907519","tags":["report"]},{"url":"https://bugzilla.suse.com/910659","tags":["report"]},{"url":"https://bugzilla.suse.com/914690","tags":["report"]},{"url":"https://bugzilla.suse.com/917150","tags":["report"]},{"url":"https://bugzilla.suse.com/918768","tags":["report"]},{"url":"https://bugzilla.suse.com/919080","tags":["report"]},{"url":"https://bugzilla.suse.com/922022","tags":["report"]},{"url":"https://bugzilla.suse.com/922451","tags":["report"]},{"url":"https://bugzilla.suse.com/922452","tags":["report"]},{"url":"https://bugzilla.suse.com/923946","tags":["report"]},{"url":"https://bugzilla.suse.com/924972","tags":["report"]},{"url":"https://bugzilla.suse.com/925109","tags":["report"]},{"url":"https://bugzilla.suse.com/928506","tags":["report"]},{"url":"https://bugzilla.suse.com/928511","tags":["report"]},{"url":"https://bugzilla.suse.com/931421","tags":["report"]},{"url":"https://bugzilla.suse.com/931769","tags":["report"]},{"url":"https://bugzilla.suse.com/931772","tags":["report"]},{"url":"https://bugzilla.suse.com/931776","tags":["report"]},{"url":"https://bugzilla.suse.com/933227","tags":["report"]},{"url":"https://bugzilla.suse.com/935074","tags":["report"]},{"url":"https://bugzilla.suse.com/935224","tags":["report"]},{"url":"https://bugzilla.suse.com/935226","tags":["report"]},{"url":"https://bugzilla.suse.com/935227","tags":["report"]},{"url":"https://bugzilla.suse.com/935232","tags":["report"]},{"url":"https://bugzilla.suse.com/935234","tags":["report"]},{"url":"https://bugzilla.suse.com/935274","tags":["report"]},{"url":"https://bugzilla.suse.com/935275","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4644","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150436-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151018-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151265-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-4635","description":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.","status":"published","published":"2013-06-21T21:00:00Z","modified":"2024-08-06T16:52:26.6Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4491","description":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.","status":"published","published":"2013-06-21T21:00:00Z","modified":"2024-08-06T16:52:26Z","updated_at":"2026-11-03T01:56:31.067159Z"}],"ghsa":[{"id":"GHSA-mw77-m68p-3ffp","title":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before...","description":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.","status":"published","published":"2022-05-17T05:04:51Z","modified":"2023-01-28T05:03:12Z","updated_at":"2026-11-02T14:43:55.582977Z"}],"nvd":[{"id":"CVE-2013-4635","description":"Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.","status":"published","published":"2013-06-21T21:55:01.08Z","modified":"2026-06-16T23:57:39.11Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"MGASA-2013-0172","title":"Updated php packages fix security vulnerabilies","description":"Heap based buffer overflow in quoted_printable_encode() in PHP before\nversion 5.4.16 (CVE-2013-2110).\n\nInteger overflow in the SdnToJewish function in jewish.c in the Calendar\ncomponent in PHP before 5.3.26 and 5.4.x before 5.4.16 allows\ncontext-dependent attackers to cause a denial of service (application hang)\nvia a large argument to the jdtojewish function. (CVE-2013-4635)\n\nThis update provides PHP version 5.4.16 which fixes this as well as\nseveral other issues.\n","status":"published","published":"2013-06-18T15:00:10Z","modified":"2026-04-16T04:44:41.542403906Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2013-0176","title":"Updated php package fixes several issues","description":"Fixed php bug #64879 (Heap based buffer overflow in quoted_printable_encode,\nCVE-2013-2110).\n\nInteger overflow in the SdnToJewish function in jewish.c in the Calendar\ncomponent in PHP before 5.3.26 and 5.4.x before 5.4.16 allows\ncontext-dependent attackers to cause a denial of service (application hang)\nvia a large argument to the jdtojewish function. (CVE-2013-4635)\n\nSee the changelog for additional bug fixes.\n","status":"published","published":"2013-06-19T10:20:15Z","modified":"2026-04-16T04:41:45.954796095Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"SUSE-SU-2015:0370-1","title":"Security update for php53","description":"\nThis update fixes the following vulnerabilities in php:\n\n    * Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)\n    * Integer overflow in unserialize(). (CVE-2014-3669)\n    * Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().\n      (CVE-2014-3668)\n\nSecurity Issues:\n\n    * CVE-2014-3669\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669\u003e\n    * CVE-2014-3670\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670\u003e\n    * CVE-2014-3668\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668\u003e\n\n","status":"published","published":"2014-10-28T10:05:33Z","modified":"2025-05-02T04:03:57.991036Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0436-1","title":"Security update for php53","description":"\nThis update fixes the following vulnerabilities in php:\n\n    * Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)\n    * Integer overflow in unserialize(). (CVE-2014-3669)\n    * Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().\n      (CVE-2014-3668)\n\nSecurity Issues:\n\n    * CVE-2014-3669\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669\u003e\n    * CVE-2014-3670\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670\u003e\n    * CVE-2014-3668\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668\u003e\n\n","status":"published","published":"2014-10-28T10:05:33Z","modified":"2026-02-04T02:53:21.704709Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1018-1","title":"Security update for php53","description":"\nThis update fixes the following vulnerabilities in php:\n\n    * Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)\n    * Integer overflow in unserialize(). (CVE-2014-3669)\n    * Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().\n      (CVE-2014-3668)\n\nSecurity Issues:\n\n    * CVE-2014-3669\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669\u003e\n    * CVE-2014-3670\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670\u003e\n    * CVE-2014-3668\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668\u003e\n\n","status":"published","published":"2014-10-28T10:05:33Z","modified":"2026-02-04T03:41:58.76149Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1265-1","title":"Security update for php53","description":"\nThis update fixes the following vulnerabilities in php:\n\n    * Heap corruption issue in exif_thumbnail(). (CVE-2014-3670)\n    * Integer overflow in unserialize(). (CVE-2014-3669)\n    * Xmlrpc ISO8601 date format parsing out-of-bounds read in mkgmtime().\n      (CVE-2014-3668)\n\nSecurity Issues:\n\n    * CVE-2014-3669\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3669\u003e\n    * CVE-2014-3670\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3670\u003e\n    * CVE-2014-3668\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3668\u003e\n\n","status":"published","published":"2014-10-28T10:05:33Z","modified":"2026-02-04T02:45:44.22952Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}