PT-2011-2608 · Php · Php

Publicado 2011-02-02 · Atualizado 2018-10-30 · CVE-2011-0752

NVD

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

The extract function in PHP before 5.2.15 does not prevent use of the EXTR OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-0752

Produtos afetados

Php

Referências · 9

• https://exchange.xforce.ibmcloud.com/vulnerabilities/65432 · Nota
• http://openwall.com/lists/oss-security/2010/12/13/4 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0752 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12016 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-0752 · Nota de Segurança
• http://php.net/archive/2010.php#id2010-12-10-1 · Nota
• http://php.net/releases/5_2_15.php · Nota
• http://marc.info/?l=bugtraq&m=133469208622507&w=2 · Aviso do Fabricante
• http://php.net/ChangeLog-5.php · Nota