CVSS: 6.8EPSS: 1%CPEs: 62EXPL: 1CVE-2009-3558
https://notcve.org/view.php?id=CVE-2009-3558
The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass open_basedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file. La función posix_mkfifo de ext/posix/posix.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a la v5.3.1, permite a atacantes dependiendo del contexto evitar las restricciones open_basedir, y crear ficheros FIFO, a través de los argumentos "pathname" y "mode", como se ha demostrado creando un fichero .htaccess. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://securityreason.com/securityalert/6600 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/posix/posix.c?view=log http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/posix/posix.c?view=log http://svn.php.net/viewvc?v • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 63EXPL: 1CVE-2009-3557
https://notcve.org/view.php?id=CVE-2009-3557
The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass safe_mode restrictions, and create files in group-writable or world-writable directories, via the dir and prefix arguments. La función tempnam de ext/standard/file.c de PHP v5.2.11 y anteriores, y v5.3.x anteriores a v5.3.1, permite a usuarios dependiendo del contexto evitar las restricciones safe_mode, y crear ficheros en directorios con permisos de sistema operativo de escritura para su grupo o para cualquier usuario, a través de los argumentos dir y prefix. • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://news.php.net/php.announce/79 http://secunia.com/advisories/37412 http://secunia.com/advisories/37821 http://secunia.com/advisories/40262 http://securityreason.com/securityalert/6601 http://support.apple.com/kb/HT4077 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/file.c?view=log http://svn.php.net/viewvc/p • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 1%CPEs: 5EXPL: 1CVE-2009-3294
https://notcve.org/view.php?id=CVE-2009-3294
The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function. La función popen de la API en el archivo TSRM/tsrm_win32.c en PHP anterior a versión 5.2.11 y versión 5.3.x anterior a 5.3.1, cuando se ejecuta en ciertos sistemas operativos de Windows, permite que los atacantes dependiendo del contexto causen una denegación de servicio (bloqueo) mediante una cadena (1) "e" o (2) "er" en el segundo argumento (también se conoce como modo), posiblemente relacionado a la función _fdopen en la biblioteca runtime de Microsoft C. NOTA: esto podría no cruzar los límites de privilegios, excepto en casos excepcionales en los que el argumento mode es accesible para un atacante fuera de una aplicación que utiliza la función popen. • http://bugs.php.net/bug.php?id=44683 http://news.php.net/php.announce/79 http://svn.php.net/viewvc?view=revision&revision=287779 http://www.openwall.com/lists/oss-security/2009/09/20/1 http://www.openwall.com/lists/oss-security/2009/11/20/2 http://www.openwall.com/lists/oss-security/2009/11/20/3 http://www.osvdb.org/58188 http://www.php.net/ChangeLog-5.php http://www.php.net/ChangeLog-5.php#5.2.11 http://www.php.net/releases/5_2& • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 1%CPEs: 109EXPL: 0CVE-2009-3292 – php: exif extension: Multiple missing sanity checks in EXIF file processing
https://notcve.org/view.php?id=CVE-2009-3292
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing." Vulnerabilidad sin especificar en PHP en versiones anteriores a la v5.2.11 tiene un impacto desconocido y vectores de ataque relacionados con un "missing sanity checks around exif processing." (comprobaciones de validez no encontradas del procesamiento exif.). • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://marc.info/?l=bugtraq&m=130497311408250&w=2 http://news.php.net/php.announce/79 http://secunia.com/advisories/36791 http://secunia.com/advisories/37412 http://secunia.com/advisories/37482 http://secunia.com/advisories/40262 http://support.apple.com/kb/HT3937 http:/ •
CVSS: 7.5EPSS: 1%CPEs: 112EXPL: 0CVE-2009-3291 – php: openssl extension: Incorrect verification of SSL certificate with NUL in name
https://notcve.org/view.php?id=CVE-2009-3291
The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates. La función php_openssl_apply_verification_policy de PHP en versiones anteriores a la v5.2.11 no realiza adecuadamente la validación de un certificado, lo que tiene un impacto y vectores de ataque desconocidos, probablemente relacionados con la posibilidad de suplantar certificados. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://marc.info/?l=bugtraq&m=127680701405735&w=2 http://marc.info/?l=bugtraq&m=130497311408250&w=2 http://secunia.com/advisories/36791 http://secunia.com/advisories/37482 http://secunia.com/advisories/40262 http://support.apple.com/kb/HT3937 http://www.debian.org/security/2009/dsa-1940 http://www.osvdb.org/58185 http:&# • CWE-20: Improper Input Validation •