PT-2012-3959 · Php+2 · Php+2

Publicado 2012-05-11 · Atualizado 2024-06-15 · CVE-2012-2335

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.12 and 5.4.2

Description The issue allows remote attackers to bypass a protection mechanism and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi main.c component and a query string beginning with a +- sequence. This is due to php-wrapper.fcgi not properly handling command-line arguments.

Recommendations For PHP version 5.3.12, update to a version that properly handles command-line arguments to prevent arbitrary code execution. For PHP version 5.4.2, update to a version that properly handles command-line arguments to prevent arbitrary code execution.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-2335

OPENSUSE-SU-2024:10290-1

OPENSUSE-SU-2024:10344-1

SUSE-SU-2012_0721-1

Produtos afetados

Hp-Ux

Php

Suse

Referências · 95

• https://suse.com/security/cve/CVE-2014-3622 · Nota
• https://suse.com/security/cve/CVE-2010-2225 · Nota
• https://suse.com/security/cve/CVE-2012-3365 · Nota
• https://suse.com/security/cve/CVE-2010-3710 · Nota
• https://suse.com/security/cve/CVE-2015-3415 · Nota
• https://suse.com/security/cve/CVE-2012-2336 · Nota
• https://suse.com/security/cve/CVE-2011-3379 · Nota
• https://suse.com/security/cve/CVE-2013-1643 · Nota
• https://suse.com/security/cve/CVE-2015-3416 · Nota
• https://suse.com/security/cve/CVE-2013-4248 · Nota
• https://bugs.php.net/bug.php?id=61910 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2012-06/msg00004.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00003.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-7327 · Nota
• https://suse.com/security/cve/CVE-2013-1824 · Nota