CVE-2007-4850
Published: 24 January 2008
curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.
Notes
Author | Note |
---|---|
jdstrand | safe mode and open_basedir. Dapper not affected (code does not exist) |
Priority
Status
Package | Release | Status |
---|---|---|
php4 Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Does not exist
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
intrepid |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
upstream |
Needed
|
|
php5 Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
edgy |
Ignored
(end of life, was needed)
|
|
feisty |
Released
(5.2.1-0ubuntu1.6)
|
|
gutsy |
Released
(5.2.3-1ubuntu6.4)
|
|
hardy |
Released
(5.2.4-2ubuntu5.3)
|
|
intrepid |
Released
(5.2.6-1ubuntu4)
|
|
jaunty |
Released
(5.2.6-1ubuntu4)
|
|
karmic |
Released
(5.2.6-1ubuntu4)
|
|
upstream |
Released
(5.2.6)
|
|
Patches: debdiff: http://launchpadlibrarian.net/15065228/php5_5.2.4-2ubuntu5.2.debdiff other: http://cvs.php.net/viewvc.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.33&r2=1.62.2.14.2.34&view=patch |