CVSS: 3.6EPSS: 0%CPEs: 54EXPL: 3CVE-2006-4625 – PHP 3 < 5 - Ini_Restore() 'Safe_mode' / 'open_basedir' Restriction Bypass
https://notcve.org/view.php?id=CVE-2006-4625
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults. PHP 4.x up a 4.4.4 y PHP 5 up a 5.1.6, permite a un usuario local evitar las opciones httpd.conf del Apache HTTP Server, al igual que safe_mode y open_basedir, a través de la función ini_restore, lo cual restaura los valores de su php.ini (valor Master) por defecto. PHP versions 5.1.6 and below and versions 4.4.4 and below suffer from a php_admin* bypass via ini_restore(). • https://www.exploit-db.com/exploits/28504 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html http://secunia.com/advisories/22282 http://secunia.com/advisories/22331 http://secunia.com/advisories/22338 http://secunia.com/advisories/22424 http://secunia.com/advisories/25423 http: •
CVSS: 9.3EPSS: 1%CPEs: 5EXPL: 0CVE-2006-4482
https://notcve.org/view.php?id=CVE-2006-4482
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. Múltiples vulnerabilidades de desbordamiento de búfer en las funciones (1) str_repeat y (2) wordwrap en ext/standard/string.c en PHP anterior a 5.1.5, cuando se uso sobre sistemas de 64-bit, tiene un impacto desconocido y ataque a vectores, una vulnerabilidad diferente que la CVE-2006-1990. • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11 http://rhn.redhat.com/errata/RHSA-2006-0688.html http://secunia.com/advisories/21546 http://secunia.com/advisories/21768 http://secunia.com/advisories/22004 http://secunia.com/advisories/22039 http://secunia.com/advisories/22069 http://secunia.com/advisories/22225 http://secunia.com/ • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 2%CPEs: 1EXPL: 0CVE-2006-4483
https://notcve.org/view.php?id=CVE-2006-4483
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache. Los ficheros con extensión cURL (1) ext/curl/interface.c y(2) ext/curl/streams.c en PHP anterior a 5.1.5 permite la opción CURLOPT_FOLLOWLOCATION cuando open_basedir o safe_mode está habilitado, lo cual permite a un atacante realizar acciones no autorizadas, posiblemente relacionado con la caché realpath. • http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4 http://secunia.com/advisories/21546 http://secunia.com/advisories/22039 http://secunia.com/advisories/30411 http://securitytracker.com/id?1016984 http://wiki.rpath.com/wiki/Advisor • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 3%CPEs: 65EXPL: 0CVE-2006-4433
https://notcve.org/view.php?id=CVE-2006-4433
PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation. PHP anterior a 4.4.3 y 5.x anterior a 5.1.4 no limita el conjunto de caracteres del identificador de sesión (PHPSESSID) para manejadores de sesión de terceros, lo cual puede hacer más fácil a atacantes remotos explotar otras vulnerabilidades insertando código PHP en el PHPSESSID, que es guardado en el fichero de sesión. NOTA: puede ser argumentado que no es una vulnerabilidad en PHP en si misma, sino más bien una limitación de diseño que habilita ciertos ataques sobre manejadores de sesión que no tienen en cuenta esta limitación. • http://secunia.com/advisories/21573 http://securityreason.com/securityalert/1466 http://www.hardened-php.net/advisory_052006.128.html http://www.osvdb.org/28233 http://www.osvdb.org/28273 http://www.securityfocus.com/archive/1/444263/100/0/threaded http://www.vupen.com/english/advisories/2006/3388 •
CVSS: 4.6EPSS: 0%CPEs: 67EXPL: 4CVE-2006-4020 – PHP 4.4.3/5.1.4 - 'sscanf' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-4020
scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. scanf.c en PHP 5.1.4 y anteriores, y 4.4.3 y anteriores, permite a atacantes (locales o remotos dependiendo del contexto) ejecutar código de su elección mediante una llamada a la función sscanf de PHP que realiza un intercambio de argumentos que incrementa un índice más allá del final de un array y dispara una lectura de búfer fuera de límite. • https://www.exploit-db.com/exploits/2193 ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc http://bugs.php.net/bug.php?id=38322 http://rhn.redhat.com/errata/RHSA-2006-0688.html http://rhn.redhat.com/errata/RHSA-2006-0736.html http://secunia.com/advisories/21403 http://secunia.com/advisories/21467 http://secunia.com/advisories/21546 http://secunia.com/advisories/21608 http://secunia.com/advisories/21683 http://secunia.com/advisories/21768 h •