PT-2006-1277 · Php+1 · Php+2

Stefan Esser · Published 2006-01-13 · Updated 2018-10-30 · CVE-2006-0200

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions 5.1.0 through 5.1.1

Description A format string issue in the error-reporting feature of the mysqli extension might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.

Recommendations For PHP versions 5.1.0 through 5.1.1, update to a version that contains a fix for this issue to prevent potential code execution.

Fix

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2006-0200

Affected Products

Mysql Server

Php

Mysqli

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2006-0200 · Security Note
• http://php.net/release_5_1_2.php · Patch
• http://secunia.com/advisories/18431 · Vendor Advisory
• http://securityfocus.com/bid/16219 · Patch
• http://hardened-php.net/advisory_022006.113.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0200 · Note
• http://xforce.iss.net/xforce/xfdb/24095 · Note
• http://vupen.com/english/advisories/2006/0369 · Note
• http://securityreason.com/securityalert/337 · Note
• http://securitytracker.com/id?1015485 · Note
• http://securityfocus.com/archive/1/421705/100/0/threaded · Note
• http://frsirt.com/english/advisories/2006/0177 · Note
• http://frsirt.com/english/advisories/2006/0369 · Note
• http://securityfocus.com/archive/1/archive/1/421705/100/0/threaded · Note
• http://vupen.com/english/advisories/2006/0177 · Note