blogsafe.org My Downloads

BlogSafe.org

PHP CVEs

Vulnerabilities in the PHP language itself, and which PHP versions they affect.

← Back to CVE list

CVE-2009-4143

HIGH 10.0 CVSS 2.0
Published
December 21, 2009
Last modified
June 16, 2026
NVD status
Modified
Reported by
secalert@redhat.com
CVSS vector
AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive.

Affected products and versions

  • PHP — Up to and including 5.2.11
  • PHP versions 1.0, 2.0, 2.0b10, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4, 4.0, 4.0.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0.7rc4, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5, 4.4.6, 4.4.7, 4.4.8, 4.4.9, 5, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.1.5, 5.1.6, 5.2.0, 5.2.1, 5.2.2, 5.2.3, 5.2.4, 5.2.5, 5.2.6, 5.2.7, 5.2.8, 5.2.9, 5.2.10

References

  • lists.apple.com http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
  • marc.info http://marc.info/?l=bugtraq&m=127680701405735&w=2
  • secunia.com http://secunia.com/advisories/37821 Vendor Advisory
  • secunia.com http://secunia.com/advisories/38648 Vendor Advisory
  • secunia.com http://secunia.com/advisories/40262 Vendor Advisory
  • secunia.com http://secunia.com/advisories/41480 Vendor Advisory
  • secunia.com http://secunia.com/advisories/41490 Vendor Advisory
  • support.apple.com http://support.apple.com/kb/HT4077
  • www.debian.org http://www.debian.org/security/2010/dsa-2001
  • www.itrc.hp.com http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995
  • www.mandriva.com http://www.mandriva.com/security/advisories?name=MDVSA-2010:045
  • www.php.net http://www.php.net/ChangeLog-5.php
  • www.php.net http://www.php.net/releases/5_2_12.php Vendor Advisory
  • www.securityfocus.com http://www.securityfocus.com/bid/37390
  • www.vupen.com http://www.vupen.com/english/advisories/2009/3593 Vendor Advisory
  • oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7439
  • nvd.nist.gov Official NVD record