CVE-2013-6712: The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict cre...

Security readout for executives and security teams

This is an old PHP denial-of-service flaw. PHP through 5.5.6 could mishandle specially crafted interval strings when creating DateInterval objects, leading to a heap-based buffer over-read and potential service disruption. Exposure is most likely in legacy PHP deployments at or below 5.5.6, especially code paths that accept user-controlled interval specifications and pass them into DateInterval parsing. Prioritize remediation for internet-facing or business-critical legacy PHP services. This appears to be a denial-of-service risk rather than data theft, but unsupported PHP versions also indicate broader security debt. Mitigation focus: Identify systems running PHP through 5.5.6 or vendor-packaged equivalents.; Apply the relevant PHP or operating system vendor security update.; Check Debian, Ubuntu, Red Hat, openSUSE, Apple, and HP advisories for package-specific guidance..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.