CVE-2009-3559

Publication date 23 November 2009

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

** DISPUTED ** main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive, which allows context-dependent attackers to have an unknown impact by triggering the failure of PHP scripts that perform include or require operations, as demonstrated by a script that attempts to perform a require_once on a file in a standard library directory. NOTE: a reliable third party reports that this is not a vulnerability, because it results in a more restrictive security policy.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
php5 9.10 karmic
Not affected
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Not affected

Notes

mdeslaur

safe_mode, and disputed 5.3.x only as per php bug report

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
php5