CVEs-PoC/2010/CVE-2010-2950.md

### [CVE-2010-2950](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2950)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

### POC

#### Reference
- https://bugzilla.redhat.com/show_bug.cgi?id=598537

#### Github
No PoCs found on GitHub currently.