CVE-2006-0200
HIGH
9.3
CVSS 2.0
Description
Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
Affected products and versions
- PHP versions 5.1.0, 5.1.1
References
- secunia.com http://secunia.com/advisories/18431 Patch, Vendor Advisory
- securityreason.com http://securityreason.com/securityalert/337
- securitytracker.com http://securitytracker.com/id?1015485
- www.hardened-php.net http://www.hardened-php.net/advisory_022006.113.html Vendor Advisory
- www.php.net http://www.php.net/release_5_1_2.php Patch
- www.securityfocus.com http://www.securityfocus.com/archive/1/421705/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/16219 Patch
- www.vupen.com http://www.vupen.com/english/advisories/2006/0177
- www.vupen.com http://www.vupen.com/english/advisories/2006/0369
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/24095
- nvd.nist.gov Official NVD record