SB2017080869 - Multiple vulnerabilities in PHP 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017080869

SB2017080869 - Multiple vulnerabilities in PHP

Published: August 8, 2017 Updated: June 8, 2025

Security Bulletin ID SB2017080869
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2008-0145)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in glob in PHP before 4.4.8, when open_basedir is enabled, has unknown impact and attack vectors. NOTE: this issue reportedly exists because of a regression related to CVE-2007-4663.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-3378)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.


Remediation

Install update from vendor's website.

References