SB2009081906 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2009081906

SB2009081906 - Multiple vulnerabilities in PHP

Published: August 19, 2009 Updated: June 12, 2025

Security Bulletin ID SB2009081906
Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 13% Medium 63% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-7002)

The vulnerability allows a local user to execute arbitrary code.

PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir restrictions for certain functions, which might allow local users to bypass intended access restrictions and call programs outside of the intended directory via the (1) exec, (2) system, (3) shell_exec, (4) passthru, or (5) popen functions, possibly involving pathnames such as "C:" drive notation.


2) Path traversal (CVE-ID: CVE-2008-5658)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the ZipArchive::extractTo function in PHP 5.2.6 and earlier. A remote authenticated attacker can send a specially crafted HTTP request and context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains . (dot dot) sequences.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-5625)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.


4) Path traversal (CVE-ID: CVE-2008-2666)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.


5) Incorrect Calculation of Buffer Size (CVE-ID: CVE-2008-0599)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.


6) Input validation error (CVE-ID: CVE-2008-1384)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c and probably other functions for formatted strings (aka *printf functions).


7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-4850)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a x00 sequence, a different vulnerability than CVE-2006-2563.


8) Input validation error (CVE-ID: CVE-2007-6039)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function.


Remediation

Install update from vendor's website.

References