CVE-2012-0789: Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of...

Security readout for executives and security teams

This is a denial-of-service issue in old PHP versions. A remote user may be able to make a PHP application consume memory by repeatedly causing date parsing through strtotime. The provided sources identify PHP before 5.3.9; no active exploitation evidence is provided. Exposure is most likely on legacy systems running PHP before 5.3.9, or vendor builds without the relevant backport. Risk depends on whether remote requests can influence high-volume date parsing paths using strtotime. Prioritize remediation where legacy PHP is internet-facing or supports critical services. The issue is old and denial-of-service focused, but unsupported PHP increases operational risk and limits reliable mitigation options. Mitigation focus: Upgrade PHP to 5.3.9 or a vendor-supported fixed backport.; Retire unsupported PHP runtimes where upgrade guidance is unavailable.; Check distribution advisories for SUSE, openSUSE, Red Hat, or applicable vendor packages..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.