PT-2008-2967 · Php · Php

Maksymilian Arciemowicz · Published 2008-03-27 · Updated 2018-10-11 · CVE-2008-1384

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.6

Description The issue is related to an integer overflow that allows context-dependent attackers to cause a denial of service and possibly have other unspecified impacts. This is achieved via a printf format parameter with a large width specifier. The problem is associated with the php sprintf appendstring function in formatted print.c and probably other functions for formatted strings, also known as *printf functions.

Recommendations For PHP versions prior to 5.2.6, update to a version 5.2.6 or later to resolve the issue.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-1384

DSA-1572-1

DTSA-135-1

Affected Products

Php

References · 25

• 🔥 http://securityreason.com/achievement_securityalert/52 · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2009:022 · Vendor Advisory
• http://debian.org/security/2008/dsa-1572 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00001.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:023 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200811-05.xml · Vendor Advisory
• http://ubuntu.com/usn/usn-628-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1384 · Security Note
• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178 · Note
• http://secunia.com/advisories/32746 · Note
• http://cvs.php.net/viewvc.cgi/php-src/NEWS?revision=1.2027.2.547.2.1120&view=markup · Note
• http://securityfocus.com/archive/1/489962/100/0/threaded · Note
• http://xforce.iss.net/xforce/xfdb/41386 · Note
• http://securityfocus.com/archive/1/492535/100/0/threaded · Note
• http://secunia.com/advisories/30967 · Note