CVE-2012-2688

Vulnerabilidad no especificada,relacionado con un "desbordamiento", en la función _php_stream_scandir en la implementación de los flujos (streams) en PHP antes de v5.3.15 y v5.4.x antes de v5.4.5 tiene un impacto desconocido y vectores de ataque a remotos.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that PHP did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. It was found that PHP did not check for carriage returns in HTTP headers, allowing intended HTTP response splitting protections to be bypassed. Depending on the web browser the victim is using, a remote attacker could use this flaw to perform HTTP response splitting attacks.