LiveActive security incident?Get immediate response
CVE Record

CVE-2012-1171: The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mech...

The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This vulnerability affects PHP 5.x handling around libxml cleanup. Under specific conditions, a remote attacker could bypass open_basedir restrictions and read files that the application was meant to block. The main business risk is exposure of local files or secrets on legacy PHP systems.

Executive priority

Prioritize if any internet-facing or multi-tenant legacy PHP 5.x systems remain. For modern supported PHP estates, urgency is lower, but confirm rather than assume because the provided affected-version data is incomplete.

Technical view

CVE-2012-1171 describes an open_basedir bypass in PHP 5.x libxml RSHUTDOWN behavior involving custom stream wrappers and a stream_close method call. The provided sources indicate arbitrary file read impact, but do not provide CVSS scoring, exact fixed versions, or current exploit evidence.

Likely exposure

Most likely exposure is legacy PHP 5.x applications that use libxml features, custom stream wrappers, and open_basedir as a containment control. The source bundle does not identify specific distributions, package versions, or non-PHP affected products.

Exploitation context

The CVE text says remote attackers can trigger arbitrary file reads through specific stream wrapper behavior. The bundle does not show CISA KEV listing or any cited evidence of active exploitation.

Researcher notes

Evidence is limited to the CVE description, PHP bug reference, Red Hat bug reference, and PHP regression test files. The supplied metadata lacks CVSS, CWE, exact patched versions, and exploit-in-the-wild confirmation.

Mitigation direction

  • Check PHP and distribution guidance for CVE-2012-1171 or PHP bug 61367.
  • Migrate PHP 5.x workloads to supported PHP versions where feasible.
  • Do not rely on open_basedir as the only file isolation boundary.
  • Restrict filesystem permissions for secrets and sensitive local files.
  • Review custom stream wrappers used with XML or libxml flows.

Validation and detection

  • Inventory externally reachable systems still running PHP 5.x.
  • Identify applications that enable open_basedir for tenant or file isolation.
  • Review code for custom stream wrappers used near libxml/XML processing.
  • Confirm whether vendor or distribution packages include the relevant fix.
  • Assess whether readable local files contain credentials or sensitive data.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2012-1171 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.