CVE-2013-6420

CVE-2013-6420 is a memory corruption vulnerability in the asn1_time_to_time_t function within PHP versions prior to 5.3.28, 5.4.23, and 5.5.7, affecting how X.509 certificate timestamps are parsed. This flaw allows remote attackers to execute arbitrary code or cause a denial of service via a specially crafted certificate, impacting various PHP deployments including those on Apple and OpenSUSE systems. The vulnerability carries a CVSS score of 7.5 (High), indicating a network-based attack with low complexity that does not require authentication, potentially leading to partial confidentiality, integrity, and availability impacts. Its FAUCET Risk Score is 97/100, highlighting its significant risk. While not listed in CISA's KEV catalog or having active Metasploit/Nuclei modules, an exploit (EDB-30395) demonstrating memory corruption is publicly available on ExploitDB. Despite this, there is no recorded community discussion or media coverage, suggesting limited public awareness or active exploitation at present.