CVE-2004-1392
MEDIUM
5.0
CVSS 2.0
Description
PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.
Affected products and versions
- PHP versions 4.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3
References
- marc.info http://marc.info/?l=bugtraq&m=109898213806099&w=2
- marc.info http://marc.info/?l=bugtraq&m=110625060220934&w=2
- securitytracker.com http://securitytracker.com/id?1011984 Exploit
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2005-405.html
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2005-406.html
- www.securityfocus.com http://www.securityfocus.com/bid/11557 Exploit, Patch
- bugzilla.fedora.us https://bugzilla.fedora.us/show_bug.cgi?id=2344 Patch
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/17900
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9279
- nvd.nist.gov Official NVD record