CVE-2004-1064
HIGH
10.0
CVSS 2.0
Description
The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
Affected products and versions
- PHP — From 4.0.0 (including) to 4.3.9 (including)
- PHP — From 5.0.0 (including) to 5.0.2 (including)
References
- distro.conectiva.com.br http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000915 Broken Link
- www.gentoo.org http://www.gentoo.org/security/en/glsa/glsa-200412-14.xml Third Party Advisory
- www.hardened-php.net http://www.hardened-php.net/advisories/012004.txt Third Party Advisory
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2004:151 Third Party Advisory
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2005:072 Third Party Advisory
- www.php.net http://www.php.net/release_4_3_10.php Release Notes, Vendor Advisory
- www.securityfocus.com http://www.securityfocus.com/advisories/9028 Third Party Advisory, VDB Entry
- www.securityfocus.com http://www.securityfocus.com/archive/1/384545 Third Party Advisory, VDB Entry
- www.securityfocus.com http://www.securityfocus.com/bid/11964 Third Party Advisory, VDB Entry
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/18512 Third Party Advisory, VDB Entry
- www.ubuntu.com https://www.ubuntu.com/usn/usn-99-1/ Third Party Advisory
- www.ubuntu.com https://www.ubuntu.com/usn/usn-99-2/ Third Party Advisory
- nvd.nist.gov Official NVD record