CVSS: 7.5EPSS: 2%CPEs: 110EXPL: 2CVE-2009-4018 – Kolang 4.3.10 < 5.3.0 - 'proc_open()' PHP 'safe_mode' Bypass
https://notcve.org/view.php?id=CVE-2009-4018
The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable. La función proc_open en ext/standard/proc_open.c en PHP anterior a v5.2.11 y v5.3.x anterior a v5.3.1 no aplica adecuadamente las directivas (1) safe_mode_allowed_env_vars y (2) safe_mode_protected_env_vars, lo que permite dependientes del contexto a atacantes ejecutar programas con un entorno de su elección a través del parámetro env, como se ha demostrado por un valor manipulado de la variable del entorno LD_LIBRARY_PATH. • https://www.exploit-db.com/exploits/11636 http://bugs.php.net/bug.php?id=49026 http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://marc.info/?l=oss-security&m=125886770008678&w=2 http://marc.info/?l=oss-security&m=125897935330618&w=2 http://secunia.com/advisories/40262 http://secunia.com/advisories/41480 http://secunia.com/advisories/41490 http://svn.php.net/viewvc/? • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 5%CPEs: 14EXPL: 1CVE-2009-4017 – PHP < 5.3.1 - 'MultiPart/form-data' Denial of Service
https://notcve.org/view.php?id=CVE-2009-4017
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive. PHP v5.2.11, y v5.3.x antes de v5.3.1, no restringen el número de archivos temporales creados al manipular una solicitud POST multipart/form-data, lo que permite a atacantes remotos causar una denegación de servicio (por agotamiento de recursos), y facilita a los atacantes remotos aprovecharse de las vulnerabilidades de inclusión de archivos locales, a través de múltiples peticiones, en relación a la falta de apoyo a la directiva max_file_uploads. • https://www.exploit-db.com/exploits/10242 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://news.php.net/php.announce/79 http://seclists.org/fulldisclosure/2009/Nov/228 http://secunia.com/advisories/37482 http://secunia.com/advisories/37821 http://secunia.com/advisories/40262 http://secunia.com/advisories/41480 http://secunia.com/advisories/41490 http://support.apple.com/kb/HT4077 ht • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.8EPSS: 1%CPEs: 62EXPL: 1CVE-2009-3558
https://notcve.org/view.php?id=CVE-2009-3558
The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file. La función posix_mkfifo de ext/posix/posix.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a la v5.3.1, permite a atacantes dependiendo del contexto evitar las restricciones open_basedir, y crear ficheros FIFO, a través de los argumentos "pathname" y "mode", como se ha demostrado creando un fichero .htaccess. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://securityreason.com/securityalert/6600 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/posix/posix.c?view=log http://svn.php.net/viewvc?v • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 63EXPL: 1CVE-2009-3557
https://notcve.org/view.php?id=CVE-2009-3557
The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments. La función tempnam de ext/standard/file.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a v5.3.1, permite a usuarios dependiendo del contexto evitar las restricciones safe_mode, y crear ficheros en directorios con permisos de sistema operativo de escritura para su grupo o para cualquier usuario, a través de los argumentos dir y prefix. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://secunia.com/advisories/40262 http://securityreason.com/securityalert/6601 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/file.c?view=log http://svn.php.net/viewvc/p • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 109EXPL: 0CVE-2009-3292 – php: exif extension: Multiple missing sanity checks in EXIF file processing
https://notcve.org/view.php?id=CVE-2009-3292
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing." Vulnerabilidad sin especificar en PHP en versiones anteriores a la v5.2.11 tiene un impacto desconocido y vectores de ataque relacionados con un "missing sanity checks around exif processing." (comprobaciones de validez no encontradas del procesamiento exif.). • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://marc.info/?l=bugtraq&m=130497311408250&w=2 http://news.php.net/php.announce/79 http://secunia.com/advisories/36791 http://secunia.com/advisories/37412 http://secunia.com/advisories/37482 http://secunia.com/advisories/40262 http://support.apple.com/kb/HT3937 http:/ •