7.5 - CVE-2008-5658

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2008-5658	First vendor Publication	2008-12-17
Vendor	Cve	Last vendor Modification	2018-10-11

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5658

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13519

Oval ID:	oval:org.mitre.oval:def:13519
Title:	DSA-1940-1 php5 -- multiple issues
Description:	Several remote vulnerabilities have been discovered in the PHP 5 hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems: The following issues have been fixed in both the stable and the oldstable distributions: CVE-2009-2687 CVE-2009-3292 The exif module did not properly handle malformed jpeg files, allowing an attacker to cause a segfault, resulting in a denial of service. CVE-2009-3291 The php_openssl_apply_verification_policy function did not properly perform certificate validation. No CVE id yet Bogdan Calin discovered that a remote attacker could cause a denial of service by uploading a large number of files in using multipart/ form-data requests, causing the creation of a large number of temporary files. To address this issue, the max_file_uploads option introduced in PHP 5.3.1 has been backported. This option limits the maximum number of files uploaded per request. The default value for this new option is 50. See NEWS.Debian for more information. The following issue has been fixed in the stable distribution: CVE-2009-2626 A flaw in the ini_restore function could lead to a memory disclosure, possibly leading to the disclosure of sensitive data. In the oldstable distribution, this update also fixes a regression introduced by the fix for CVE-2008-5658 in DSA-1789-1. For the stable distribution, these problems have been fixed in version 5.2.6.dfsg.1-1+lenny4. The oldstable distribution, these problems have been fixed in version 5.2.0+dfsg-8+etch16. For the testing distribution and the unstable distribution , these problems will be fixed in version 5.2.11.dfsg.1-2. We recommend that you upgrade your php5 packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1940-1 CVE-2009-2626 CVE-2009-2687 CVE-2009-3291 CVE-2009-3292 CVE-2008-5658	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	php5
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section php-pear DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5 DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section php5-recode DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-xmlrpc DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-curl DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-snmp DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mysql DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-odbc DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-xsl DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-gd DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND libapache2-mod-php5 DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mhash DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-tidy DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mcrypt DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-dev DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-pgsql DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-gmp DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-cgi DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-imap DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-sqlite DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-ldap DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-cli DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-sybase DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND libapache2-mod-php5filter DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-pspell DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-common DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-dbg DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is amd64 AND php5-interbase DPKG is earlier than 5.2.6.dfsg.1-1+lenny4 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section php5 DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php-pear DPKG is earlier than 5.2.0+dfsg-8+etch16 AND libapache-mod-php5 DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-recode DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-cgi DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-curl DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-snmp DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-mysql DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-odbc DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-xsl DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-gd DPKG is earlier than 5.2.0+dfsg-8+etch16 AND libapache2-mod-php5 DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-mhash DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-tidy DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-mcrypt DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-dev DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-pgsql DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-xmlrpc DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-imap DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-sqlite DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-ldap DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-cli DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-sybase DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-pspell DPKG is earlier than 5.2.0+dfsg-8+etch16 AND php5-common DPKG is earlier than 5.2.0+dfsg-8+etch16 OR Architecture depended section Supported architectures section Installed architecture is i386 AND Installed architecture is amd64 AND php5-interbase DPKG is earlier than 5.2.0+dfsg-8+etch16

Definition Id: oval:org.mitre.oval:def:7890

Oval ID:	oval:org.mitre.oval:def:7890
Title:	DSA-1940 php5 -- multiple issues
Description:	Several remote vulnerabilities have been discovered in the PHP 5 hypertext preprocessor. The Common Vulnerabilities and Exposures project identifies the following problems: The following issues have been fixed in both the stable (lenny) and the oldstable (etch) distributions: CVE-2009-2687, CVE-2009-3292. The exif module did not properly handle malformed jpeg files, allowing an attacker to cause a segfault, resulting in a denial of service. The php_openssl_apply_verification_policy() function did not properly perform certificate validation. Bogdan Calin discovered that a remote attacker could cause a denial of service by uploading a large number of files in using multipart/ form-data requests, causing the creation of a large number of temporary files. To address this issue, the max_file_uploads option introduced in PHP 5.3.1 has been backported. This option limits the maximum number of files uploaded per request. The default value for this new option is 50. See NEWS.Debian for more information. The following issue has been fixed in the stable (lenny) distribution: A flaw in the ini_restore() function could lead to a memory disclosure, possibly leading to the disclosure of sensitive data. In the oldstable (etch) distribution, this update also fixes a regression introduced by the fix for CVE-2008-5658 in DSA-1789-1 (bug #527560).
Family:	unix	Class:	patch
Reference(s):	DSA-1940 CVE-2009-2626 CVE-2009-2687 CVE-2009-3291 CVE-2009-3292 CVE-2008-5658	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	php5
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section php-pear is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5 is earlier than 5.2.6.dfsg.1-1+lenny4 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section php5-recode is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-cgi is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-curl is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-snmp is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mysql is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-odbc is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-xsl is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-gd is earlier than 5.2.6.dfsg.1-1+lenny4 AND libapache2-mod-php5 is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mhash is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-tidy is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-mcrypt is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-dev is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-pgsql is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-gmp is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-xmlrpc is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-imap is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-sqlite is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-ldap is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-cli is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-sybase is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-pspell is earlier than 5.2.6.dfsg.1-1+lenny4 AND libapache2-mod-php5filter is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-common is earlier than 5.2.6.dfsg.1-1+lenny4 AND php5-dbg is earlier than 5.2.6.dfsg.1-1+lenny4 OR Architecture dependent section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is amd64 AND php5-interbase is earlier than 5.2.6.dfsg.1-1+lenny4 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section php5 is earlier than 5.2.0+dfsg-8+etch16 AND php-pear is earlier than 5.2.0+dfsg-8+etch16 AND libapache-mod-php5 is earlier than 5.2.0+dfsg-8+etch16 AND php5-recode is earlier than 5.2.0+dfsg-8+etch16 AND php5-xmlrpc is earlier than 5.2.0+dfsg-8+etch16 AND php5-curl is earlier than 5.2.0+dfsg-8+etch16 AND php5-snmp is earlier than 5.2.0+dfsg-8+etch16 AND php5-mysql is earlier than 5.2.0+dfsg-8+etch16 AND php5-odbc is earlier than 5.2.0+dfsg-8+etch16 AND php5-xsl is earlier than 5.2.0+dfsg-8+etch16 AND php5-gd is earlier than 5.2.0+dfsg-8+etch16 AND libapache2-mod-php5 is earlier than 5.2.0+dfsg-8+etch16 AND php5-mhash is earlier than 5.2.0+dfsg-8+etch16 AND php5-tidy is earlier than 5.2.0+dfsg-8+etch16 AND php5-mcrypt is earlier than 5.2.0+dfsg-8+etch16 AND php5-dev is earlier than 5.2.0+dfsg-8+etch16 AND php5-pgsql is earlier than 5.2.0+dfsg-8+etch16 AND php5-cgi is earlier than 5.2.0+dfsg-8+etch16 AND php5-imap is earlier than 5.2.0+dfsg-8+etch16 AND php5-sqlite is earlier than 5.2.0+dfsg-8+etch16 AND php5-ldap is earlier than 5.2.0+dfsg-8+etch16 AND php5-cli is earlier than 5.2.0+dfsg-8+etch16 AND php5-sybase is earlier than 5.2.0+dfsg-8+etch16 AND php5-pspell is earlier than 5.2.0+dfsg-8+etch16 AND php5-common is earlier than 5.2.0+dfsg-8+etch16 OR Architecture dependent section Supported architectures section Installed architecture is i386 AND Installed architecture is amd64 AND php5-interbase is earlier than 5.2.0+dfsg-8+etch16

CPE : Common Platform Enumeration

Type	Description	Count
Application	Php cpe:2.3:a:php:php:5.2.6:-:::::: cpe:2.3:a:php:php:5.2.6:rc1:::::: cpe:2.3:a:php:php:5.2.6:rc2:::::: cpe:2.3:a:php:php:5.2.6:rc3:::::: cpe:2.3:a:php:php:5.2.6:rc4:::::: cpe:2.3:a:php:php:5.2.6:rc5:::::: cpe:2.3:a:php:php:5.2.5:-:::::: cpe:2.3:a:php:php:5.2.5:rc1:::::: cpe:2.3:a:php:php:5.2.5:rc2:::::: cpe:2.3:a:php:php:5.2.4::windows::::: cpe:2.3:a:php:php:5.2.4:-:::::: cpe:2.3:a:php:php:5.2.4:rc1:::::: cpe:2.3:a:php:php:5.2.4:rc2:::::: cpe:2.3:a:php:php:5.2.4:rc3:::::: cpe:2.3:a:php:php:5.2.3:-:::::: cpe:2.3:a:php:php:5.2.3:rc1:::::: cpe:2.3:a:php:php:5.2.2:-:::::: cpe:2.3:a:php:php:5.2.2:rc1:::::: cpe:2.3:a:php:php:5.2.2:rc2:::::: cpe:2.3:a:php:php:5.2.1:-:::::: cpe:2.3:a:php:php:5.2.1:rc1:::::: cpe:2.3:a:php:php:5.2.1:rc2:::::: cpe:2.3:a:php:php:5.2.1:rc3:::::: cpe:2.3:a:php:php:5.2.1:rc4:::::: cpe:2.3:a:php:php:5.2.0:::::::* cpe:2.3:a:php:php:5.2.0:rc1:::::: cpe:2.3:a:php:php:5.2.0:rc2:::::: cpe:2.3:a:php:php:5.2.0:rc3:::::: cpe:2.3:a:php:php:5.2.0:rc4:::::: cpe:2.3:a:php:php:5.2.0:rc5:::::: cpe:2.3:a:php:php:5.2.0:rc6:::::: cpe:2.3:a:php:php:5.1.6:::::::* cpe:2.3:a:php:php:5.1.5:-:::::: cpe:2.3:a:php:php:5.1.5:rc1:::::: cpe:2.3:a:php:php:5.1.4:::::::* cpe:2.3:a:php:php:5.1.3:::::::* cpe:2.3:a:php:php:5.1.3:rc1:::::: cpe:2.3:a:php:php:5.1.3:rc2:::::: cpe:2.3:a:php:php:5.1.3:rc3:::::: cpe:2.3:a:php:php:5.1.2:-:::::: cpe:2.3:a:php:php:5.1.2:rc1:::::: cpe:2.3:a:php:php:5.1.2:rc2:::::: cpe:2.3:a:php:php:5.1.1:::::::* cpe:2.3:a:php:php:5.1.0:-:::::: cpe:2.3:a:php:php:5.1.0:beta1:::::: cpe:2.3:a:php:php:5.1.0:beta2:::::: cpe:2.3:a:php:php:5.1.0:beta3:::::: cpe:2.3:a:php:php:5.1.0:rc1:::::: cpe:2.3:a:php:php:5.1.0:rc2:::::: cpe:2.3:a:php:php:5.1.0:rc2-pre:::::: cpe:2.3:a:php:php:5.1.0:rc3:::::: cpe:2.3:a:php:php:5.1.0:rc4:::::: cpe:2.3:a:php:php:5.1.0:rc5:::::: cpe:2.3:a:php:php:5.1.0:rc6:::::: cpe:2.3:a:php:php:5.0.5:-:::::: cpe:2.3:a:php:php:5.0.5:rc1:::::: cpe:2.3:a:php:php:5.0.5:rc2:::::: cpe:2.3:a:php:php:5.0.4:-:::::: cpe:2.3:a:php:php:5.0.4:rc1:::::: cpe:2.3:a:php:php:5.0.4:rc2:::::: cpe:2.3:a:php:php:5.0.3:-:::::: cpe:2.3:a:php:php:5.0.3:rc1:::::: cpe:2.3:a:php:php:5.0.3:rc2:::::: cpe:2.3:a:php:php:5.0.2:-:::::: cpe:2.3:a:php:php:5.0.2:rc1:::::: cpe:2.3:a:php:php:5.0.1:-:::::: cpe:2.3:a:php:php:5.0.1:beta1:::::: cpe:2.3:a:php:php:5.0.1:rc1:::::: cpe:2.3:a:php:php:5.0.1:rc2:::::: cpe:2.3:a:php:php:5.0.0:beta3:::::: cpe:2.3:a:php:php:5.0.0:rc3:::::: cpe:2.3:a:php:php:5.0.0:beta1:::::: cpe:2.3:a:php:php:5.0.0:beta4:::::: cpe:2.3:a:php:php:5.0.0:rc1:::::: cpe:2.3:a:php:php:5.0.0:beta2:::::: cpe:2.3:a:php:php:5.0.0:rc2:::::: cpe:2.3:a:php:php:5.0.0:-:::::: cpe:2.3:a:php:php:5.0:rc1:::::: cpe:2.3:a:php:php:5.0:rc3:::::: cpe:2.3:a:php:php:5.0:rc2:::::: cpe:2.3:a:php:php:5:::::::* cpe:2.3:a:php:php:4.4.9:-:::::: cpe:2.3:a:php:php:4.4.9:rc1:::::: cpe:2.3:a:php:php:4.4.8:-:::::: cpe:2.3:a:php:php:4.4.8:rc1:::::: cpe:2.3:a:php:php:4.4.7:-:::::: cpe:2.3:a:php:php:4.4.7:rc1:::::: cpe:2.3:a:php:php:4.4.6:-:::::: cpe:2.3:a:php:php:4.4.6:rc1:::::: cpe:2.3:a:php:php:4.4.5:-:::::: cpe:2.3:a:php:php:4.4.5:rc1:::::: cpe:2.3:a:php:php:4.4.5:rc2:::::: cpe:2.3:a:php:php:4.4.4:-:::::: cpe:2.3:a:php:php:4.4.4:rc1:::::: cpe:2.3:a:php:php:4.4.3:-:::::: cpe:2.3:a:php:php:4.4.3:rc1:::::: cpe:2.3:a:php:php:4.4.3:rc2:::::: cpe:2.3:a:php:php:4.4.2:-:::::: cpe:2.3:a:php:php:4.4.2:rc1:::::: cpe:2.3:a:php:php:4.4.2:rc2:::::: cpe:2.3:a:php:php:4.4.1:-:::::: cpe:2.3:a:php:php:4.4.1:rc1:::::: cpe:2.3:a:php:php:4.4.0:-:::::: cpe:2.3:a:php:php:4.4.0:rc1:::::: cpe:2.3:a:php:php:4.4.0:rc2:::::: cpe:2.3:a:php:php:4.3.9:::::::* cpe:2.3:a:php:php:4.3.9:rc1:::::: cpe:2.3:a:php:php:4.3.9:rc2:::::: cpe:2.3:a:php:php:4.3.9:rc3:::::: cpe:2.3:a:php:php:4.3.8:::::::* cpe:2.3:a:php:php:4.3.7:-:::::: cpe:2.3:a:php:php:4.3.7:rc1:::::: cpe:2.3:a:php:php:4.3.6:-:::::: cpe:2.3:a:php:php:4.3.6:rc1:::::: cpe:2.3:a:php:php:4.3.6:rc2:::::: cpe:2.3:a:php:php:4.3.6:rc3:::::: cpe:2.3:a:php:php:4.3.5:-:::::: cpe:2.3:a:php:php:4.3.5:rc1:::::: cpe:2.3:a:php:php:4.3.5:rc2:::::: cpe:2.3:a:php:php:4.3.5:rc3:::::: cpe:2.3:a:php:php:4.3.5:rc4:::::: cpe:2.3:a:php:php:4.3.4:-:::::: cpe:2.3:a:php:php:4.3.4:rc1:::::: cpe:2.3:a:php:php:4.3.4:rc2:::::: cpe:2.3:a:php:php:4.3.4:rc3:::::: cpe:2.3:a:php:php:4.3.3:-:::::: cpe:2.3:a:php:php:4.3.3:rc1:::::: cpe:2.3:a:php:php:4.3.3:rc2:::::: cpe:2.3:a:php:php:4.3.3:rc3:::::: cpe:2.3:a:php:php:4.3.3:rc4:::::: cpe:2.3:a:php:php:4.3.2:-:::::: cpe:2.3:a:php:php:4.3.2:rc1:::::: cpe:2.3:a:php:php:4.3.2:rc2:::::: cpe:2.3:a:php:php:4.3.2:rc3:::::: cpe:2.3:a:php:php:4.3.2:rc4:::::: cpe:2.3:a:php:php:4.3.11:-:::::: cpe:2.3:a:php:php:4.3.11:rc1:::::: cpe:2.3:a:php:php:4.3.11:rc2:::::: cpe:2.3:a:php:php:4.3.10:-:::::: cpe:2.3:a:php:php:4.3.10:rc1:::::: cpe:2.3:a:php:php:4.3.10:rc2:::::: cpe:2.3:a:php:php:4.3.1:::::::* cpe:2.3:a:php:php:4.3.0:-:::::: cpe:2.3:a:php:php:4.3.0:alpha1:::::: cpe:2.3:a:php:php:4.3.0:alpha2:::::: cpe:2.3:a:php:php:4.3.0:alpha3:::::: cpe:2.3:a:php:php:4.3.0:dev:::::: cpe:2.3:a:php:php:4.3.0:pre1:::::: cpe:2.3:a:php:php:4.3.0:pre2:::::: cpe:2.3:a:php:php:4.3.0:rc1:::::: cpe:2.3:a:php:php:4.3.0:rc2:::::: cpe:2.3:a:php:php:4.3.0:rc3:::::: cpe:2.3:a:php:php:4.3.0:rc4:::::: cpe:2.3:a:php:php:4.2.3:-:::::: cpe:2.3:a:php:php:4.2.3:rc1:::::: cpe:2.3:a:php:php:4.2.3:rc2:::::: cpe:2.3:a:php:php:4.2.2:::::::* cpe:2.3:a:php:php:4.2.1:-:::::: cpe:2.3:a:php:php:4.2.1:rc1:::::: cpe:2.3:a:php:php:4.2.1:rc2:::::: cpe:2.3:a:php:php:4.2.0:-:::::: cpe:2.3:a:php:php:4.2.0:rc1:::::: cpe:2.3:a:php:php:4.2.0:rc2:::::: cpe:2.3:a:php:php:4.2.0:rc3:::::: cpe:2.3:a:php:php:4.2.0:rc4:::::: cpe:2.3:a:php:php:4.2::dev::::: cpe:2.3:a:php:php:4.1.2:::::::* cpe:2.3:a:php:php:4.1.1:::::::* cpe:2.3:a:php:php:4.1.0:-:::::: cpe:2.3:a:php:php:4.1.0:rc1:::::: cpe:2.3:a:php:php:4.1.0:rc2:::::: cpe:2.3:a:php:php:4.1.0:rc3:::::: cpe:2.3:a:php:php:4.1.0:rc4:::::: cpe:2.3:a:php:php:4.1.0:rc5:::::: cpe:2.3:a:php:php:4.0.7:rc3:::::: cpe:2.3:a:php:php:4.0.7:rc2:::::: cpe:2.3:a:php:php:4.0.7:rc4:::::: cpe:2.3:a:php:php:4.0.7:rc1:::::: cpe:2.3:a:php:php:4.0.7:-:::::: cpe:2.3:a:php:php:4.0.6:-:::::: cpe:2.3:a:php:php:4.0.6:rc1:::::: cpe:2.3:a:php:php:4.0.6:rc2:::::: cpe:2.3:a:php:php:4.0.6:rc3:::::: cpe:2.3:a:php:php:4.0.6:rc4:::::: cpe:2.3:a:php:php:4.0.5:-:::::: cpe:2.3:a:php:php:4.0.5:rc1:::::: cpe:2.3:a:php:php:4.0.5:rc2:::::: cpe:2.3:a:php:php:4.0.5:rc3:::::: cpe:2.3:a:php:php:4.0.5:rc4:::::: cpe:2.3:a:php:php:4.0.5:rc5:::::: cpe:2.3:a:php:php:4.0.5:rc6:::::: cpe:2.3:a:php:php:4.0.5:rc7:::::: cpe:2.3:a:php:php:4.0.5:rc8:::::: cpe:2.3:a:php:php:4.0.4pl1:::::::* cpe:2.3:a:php:php:4.0.4:patch1:::::: cpe:2.3:a:php:php:4.0.4:-:::::: cpe:2.3:a:php:php:4.0.4:rc1:::::: cpe:2.3:a:php:php:4.0.4:rc2:::::: cpe:2.3:a:php:php:4.0.4:rc3:::::: cpe:2.3:a:php:php:4.0.4:rc4:::::: cpe:2.3:a:php:php:4.0.4:rc5:::::: cpe:2.3:a:php:php:4.0.4:rc6:::::: cpe:2.3:a:php:php:4.0.3:::::::* cpe:2.3:a:php:php:4.0.3:patch1:::::: cpe:2.3:a:php:php:4.0.3:rc1:::::: cpe:2.3:a:php:php:4.0.3:rc2:::::: cpe:2.3:a:php:php:4.0.2:::::::* cpe:2.3:a:php:php:4.0.2:rc1:::::: cpe:2.3:a:php:php:4.0.1:patch2:::::: cpe:2.3:a:php:php:4.0.1:patch1:::::: cpe:2.3:a:php:php:4.0.1:-:::::: cpe:2.3:a:php:php:4.0.1:rc:::::: cpe:2.3:a:php:php:4.0.1:rc2:::::: cpe:2.3:a:php:php:4.0.0:::::::* cpe:2.3:a:php:php:4.0:beta1:::::: cpe:2.3:a:php:php:4.0:beta2:::::: cpe:2.3:a:php:php:4.0:beta3:::::: cpe:2.3:a:php:php:4.0:beta4:::::: cpe:2.3:a:php:php:4.0:beta_4_patch1:::::: cpe:2.3:a:php:php:4.0:rc1:::::: cpe:2.3:a:php:php:4.0:rc2:::::: cpe:2.3:a:php:php:4.0:-:::::: cpe:2.3:a:php:php:4:::::::* cpe:2.3:a:php:php:3.0.9:::::::* cpe:2.3:a:php:php:3.0.8:::::::* cpe:2.3:a:php:php:3.0.7:::::::* cpe:2.3:a:php:php:3.0.6:::::::* cpe:2.3:a:php:php:3.0.5:::::::* cpe:2.3:a:php:php:3.0.4:::::::* cpe:2.3:a:php:php:3.0.3:::::::* cpe:2.3:a:php:php:3.0.2:::::::* cpe:2.3:a:php:php:3.0.18:::::::* cpe:2.3:a:php:php:3.0.17:::::::* cpe:2.3:a:php:php:3.0.16:::::::* cpe:2.3:a:php:php:3.0.15:::::::* cpe:2.3:a:php:php:3.0.14:::::::* cpe:2.3:a:php:php:3.0.13:::::::* cpe:2.3:a:php:php:3.0.12:::::::* cpe:2.3:a:php:php:3.0.11:::::::* cpe:2.3:a:php:php:3.0.10:::::::* cpe:2.3:a:php:php:3.0.1:::::::* cpe:2.3:a:php:php:3.0:::::::* cpe:2.3:a:php:php:2.0b10:::::::* cpe:2.3:a:php:php:2.0.2:::::::* cpe:2.3:a:php:php:2.0.1:::::::* cpe:2.3:a:php:php:2.0.0:-:::::: cpe:2.3:a:php:php:2.0.0:alpha1:::::: cpe:2.3:a:php:php:2.0.0:alpha2:::::: cpe:2.3:a:php:php:2.0.0:beta1:::::: cpe:2.3:a:php:php:2.0.0:rc1:::::: cpe:2.3:a:php:php:2.0:::::::* cpe:2.3:a:php:php:1.5:::::::* cpe:2.3:a:php:php:1.4:::::::* cpe:2.3:a:php:php:1.3.5:::::::* cpe:2.3:a:php:php:1.3.1:::::::* cpe:2.3:a:php:php:1.3:-:::::: cpe:2.3:a:php:php:1.3:beta2:::::: cpe:2.3:a:php:php:1.3:beta3:::::: cpe:2.3:a:php:php:1.3:beta6:::::: cpe:2.3:a:php:php:1.2.5:::::::* cpe:2.3:a:php:php:1.2.4:::::::* cpe:2.3:a:php:php:1.2.3:::::::* cpe:2.3:a:php:php:1.2.2:::::::* cpe:2.3:a:php:php:1.2.1:::::::* cpe:2.3:a:php:php:1.2.0:::::::* cpe:2.3:a:php:php:1.2:::::::* cpe:2.3:a:php:php:1.1.1:::::::* cpe:2.3:a:php:php:1.1.0:::::::* cpe:2.3:a:php:php:1.1:::::::* cpe:2.3:a:php:php:1.0.4:::::::* cpe:2.3:a:php:php:1.0.3:::::::* cpe:2.3:a:php:php:1.0.2:::::::* cpe:2.3:a:php:php:1.0.1:::::::* cpe:2.3:a:php:php:1.0.0:-:::::: cpe:2.3:a:php:php:1.0.0:rc1:::::: cpe:2.3:a:php:php:1.0:beta1:::::: cpe:2.3:a:php:php:1.0:beta2:::::: cpe:2.3:a:php:php:1.0:beta3:::::: cpe:2.3:a:php:php:1.0:rc1:::::: cpe:2.3:a:php:php:1.0:rc2:::::: cpe:2.3:a:php:php:0.91:::::::* cpe:2.3:a:php:php:0.90:::::::* cpe:2.3:a:php:php:0.9.4:::::::* cpe:2.3:a:php:php:0.9.3:::::::* cpe:2.3:a:php:php:0.9.2:::::::* cpe:2.3:a:php:php:0.9.1:::::::* cpe:2.3:a:php:php:0.9.0:::::::* cpe:2.3:a:php:php:0.9:::::::* cpe:2.3:a:php:php:0.7:::::::* cpe:2.3:a:php:php:0.6:::::::* cpe:2.3:a:php:php:0.5.3:::::::* cpe:2.3:a:php:php:0.5.2:::::::* cpe:2.3:a:php:php:0.5:::::::* cpe:2.3:a:php:php:0.4:::::::* cpe:2.3:a:php:php:0.3:::::::* cpe:2.3:a:php:php:0.2.4:::::::* cpe:2.3:a:php:php:0.2.3:::::::* cpe:2.3:a:php:php:0.2.2:::::::* cpe:2.3:a:php:php:0.2.1:::::::* cpe:2.3:a:php:php:0.2.0:::::::* cpe:2.3:a:php:php:0.2:::::::* cpe:2.3:a:php:php:0.11:::::::* cpe:2.3:a:php:php:0.10:::::::* cpe:2.3:a:php:php:0.1.1:::::::* cpe:2.3:a:php:php:0.1:::::::* cpe:2.3:a:php:php:::::::: cpe:2.3:a:php:php:-:::::::*	307

OpenVAS Exploits

Date	Description
2012-06-21	Name : PHP version smaller than 5.2.7 File : nvt/nopsec_php_5_2_7.nasl
2010-01-07	Name : Gentoo Security Advisory GLSA 201001-03 (php) File : nvt/glsa_201001_03.nasl
2009-10-22	Name : HP-UX Update for Apache-based Web Server HPSBUX02465 File : nvt/gb_hp_ux_HPSBUX02465.nasl
2009-10-13	Name : SLES10: Security update for PHP5 File : nvt/sles10_apache2-mod_php0.nasl
2009-07-17	Name : HP-UX Update for Apache Web Server Suite HPSBUX02431 File : nvt/gb_hp_ux_HPSBUX02431.nasl
2009-06-05	Name : Fedora Core 10 FEDORA-2009-3768 (maniadrive) File : nvt/fcore_2009_3768.nasl
2009-06-05	Name : Fedora Core 9 FEDORA-2009-3848 (maniadrive) File : nvt/fcore_2009_3848.nasl
2009-06-05	Name : Ubuntu USN-719-1 (libpam-krb5) File : nvt/ubuntu_719_1.nasl
2009-06-05	Name : Ubuntu USN-720-1 (php5) File : nvt/ubuntu_720_1.nasl
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-06-05	Name : Ubuntu USN-769-1 (libwmf) File : nvt/ubuntu_769_1.nasl
2009-05-11	Name : Debian Security Advisory DSA 1789-1 (php5) File : nvt/deb_1789_1.nasl
2009-04-15	Name : RedHat Security Advisory RHSA-2009:0350 File : nvt/RHSA_2009_0350.nasl
2009-02-23	Name : Mandrake Security Advisory MDVSA-2009:045 (php) File : nvt/mdksa_2009_045.nasl
2009-02-18	Name : SuSE Security Summary SUSE-SR:2009:004 File : nvt/suse_sr_2009_004.nasl
2008-12-26	Name : PHP Security Bypass and File Writing Vulnerability - Dec08 File : nvt/secpod_php_sec_bypass_n_file_write_vuln_900184.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
50480	PHP ZipArchive::extractTo() ZIP File Traversal Arbitrary File Overwrite

Nessus® Vulnerability Scanner

Date	Description
2010-02-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201001-03.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1940.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_apache2-mod_php5-5909.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_apache2-mod_php5-090114.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_apache2-mod_php5-090119.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3768.nasl - Type : ACT_GATHER_INFO
2009-06-01	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-3848.nasl - Type : ACT_GATHER_INFO
2009-05-06	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1789.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-045.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-720-1.nasl - Type : ACT_GATHER_INFO
2009-02-06	Name : The remote openSUSE host is missing a security update. File : suse_apache2-mod_php5-5934.nasl - Type : ACT_GATHER_INFO
2008-12-05	Name : The remote web server uses a version of PHP that is affected by multiple vuln... File : php_5_2_7.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/32625
BUGTRAQ	http://archives.neohapsis.com/archives/bugtraq/2008-12/0039.html http://www.securityfocus.com/archive/1/501376/100/0/threaded
CONFIRM	http://wiki.rpath.com/Advisories:rPSA-2009-0035 http://www.php.net/ChangeLog-5.php#5.2.7
DEBIAN	http://www.debian.org/security/2009/dsa-1789
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html
HP	http://marc.info/?l=bugtraq&m=124654546101607&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:045
MISC	http://www.sektioneins.de/advisories/SE-2008-06.txt
MLIST	http://www.openwall.com/lists/oss-security/2008/12/04/3
OSVDB	http://osvdb.org/50480
REDHAT	http://www.redhat.com/support/errata/RHSA-2009-0350.html
SECTRACK	http://www.securitytracker.com/id?1021303
SECUNIA	http://secunia.com/advisories/35003 http://secunia.com/advisories/35306 http://secunia.com/advisories/35650
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/47079

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:09:55	Multiple Updates
2024-02-01 12:02:53	Multiple Updates
2023-09-05 12:09:16	Multiple Updates
2023-09-05 01:02:44	Multiple Updates
2023-09-02 12:09:22	Multiple Updates
2023-09-02 01:02:45	Multiple Updates
2023-08-12 12:10:59	Multiple Updates
2023-08-12 01:02:45	Multiple Updates
2023-08-11 12:09:24	Multiple Updates
2023-08-11 01:02:51	Multiple Updates
2023-08-06 12:09:01	Multiple Updates
2023-08-06 01:02:46	Multiple Updates
2023-08-04 12:09:06	Multiple Updates
2023-08-04 01:02:49	Multiple Updates
2023-07-14 12:09:05	Multiple Updates
2023-07-14 01:02:46	Multiple Updates
2023-03-29 01:10:20	Multiple Updates
2023-03-28 12:02:52	Multiple Updates
2022-10-11 12:08:04	Multiple Updates
2022-10-11 01:02:36	Multiple Updates
2021-05-04 12:08:33	Multiple Updates
2021-04-22 01:08:55	Multiple Updates
2020-05-24 01:05:11	Multiple Updates
2020-05-23 00:22:46	Multiple Updates
2019-06-08 12:02:39	Multiple Updates
2019-03-18 12:01:54	Multiple Updates
2018-10-12 00:20:31	Multiple Updates
2018-10-04 12:05:10	Multiple Updates
2017-08-08 09:24:35	Multiple Updates
2016-10-13 01:01:05	Multiple Updates
2016-06-28 17:23:11	Multiple Updates
2016-04-26 18:09:35	Multiple Updates
2014-02-17 10:47:43	Multiple Updates
2013-05-11 00:33:12	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	307
Sources(s)	21
osvdb(s)	1
Openvas Exploit(s)	16
Nessus® Exploit(s)	12

	Related
10	USN-720-1
10	RHSA-2009:0350
10	MDVSA-2009:045
10	HPSBUX02465 SSR...
10	GLSA-201001-03
10	DSA-1789
7.5	DSA-1940
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)