CVE-2012-6113: The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a cer...

Security readout for executives and security teams

This is an old PHP OpenSSL memory disclosure bug. A vulnerable application path that lets a remote user trigger openssl_encrypt with zero bytes of input could expose sensitive data from the PHP process memory. The sources do not provide CVSS, real-world exploit evidence, or detailed impact scope. Likely exposure is legacy systems running PHP 5.3.9 through 5.3.13, especially web applications with reachable code paths that call openssl_encrypt on remote-controlled empty input. Treat as a legacy exposure cleanup item. It is not presented as actively exploited, but vulnerable PHP versions are long obsolete and can create avoidable sensitive-data disclosure risk. Mitigation focus: Identify and retire PHP 5.3.9 through 5.3.13 runtimes.; Apply vendor-supported PHP updates or distribution packages referenced by PHP and Ubuntu guidance.; Review exposed application paths using openssl_encrypt with user-controlled input..

Prepared

Jun 24, 2026, 12:04 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.