PHP CVEs

Description

The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.

Affected products and versions

• PHP versions 4.0, 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2

References

• secunia.com http://secunia.com/advisories/19599 Exploit, Patch, Vendor Advisory
• secunia.com http://secunia.com/advisories/19775
• secunia.com http://secunia.com/advisories/21125
• securityreason.com http://securityreason.com/achievement_securityalert/37 Exploit, Patch
• securityreason.com http://securityreason.com/securityalert/678
• securitytracker.com http://securitytracker.com/id?1015882
• us.php.net http://us.php.net/releases/5_1_3.php
• www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:074
• www.osvdb.org http://www.osvdb.org/24487
• www.securityfocus.com http://www.securityfocus.com/archive/1/430461/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/archive/1/440869/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/archive/1/441210/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/17439
• www.ubuntu.com http://www.ubuntu.com/usn/usn-320-1
• www.vupen.com http://www.vupen.com/english/advisories/2006/1290
• exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/25706
• nvd.nist.gov Official NVD record