blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2009-4018

HIGH 7.5 CVSS 2.0
Published
November 29, 2009
Last modified
June 16, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-264
CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LD_LIBRARY_PATH environment variable.

Affected products and versions

  • PHP — Up to and including 5.2.10
  • PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4, 4.0, 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0.7rc4, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.2, 5.2.4, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.3.0

References

  • bugs.php.net http://bugs.php.net/bug.php?id=49026 Exploit, Patch
  • marc.info http://marc.info/?l=bugtraq&m=127680701405735&w=2
  • marc.info http://marc.info/?l=oss-security&m=125886770008678&w=2 Patch
  • marc.info http://marc.info/?l=oss-security&m=125897935330618&w=2 Patch
  • secunia.com http://secunia.com/advisories/40262
  • secunia.com http://secunia.com/advisories/41480
  • secunia.com http://secunia.com/advisories/41490
  • svn.php.net http://svn.php.net/viewvc/?view=revision&revision=286360 Patch
  • svn.php.net http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/standard/proc_open.c?r1=286360&r2=286359&pathrev=286360 Patch
  • svn.php.net http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/standard/proc_open.c?r1=286360&r2=286359&pathrev=286360 Patch
  • www.itrc.hp.com http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995
  • www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2009:303
  • www.openwall.com http://www.openwall.com/lists/oss-security/2009/11/23/15 Patch
  • www.php.net http://www.php.net/ChangeLog-5.php
  • www.securityfocus.com http://www.securityfocus.com/bid/37138
  • oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7256
  • nvd.nist.gov Official NVD record