PT-2009-6313 · Php+1 · Php+1

Stefan Esser · Published 2009-12-21 · Updated 2018-10-30 · CVE-2009-4143

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.12

Description The issue is related to the handling of session data. It involves interrupt corruption of the SESSION superglobal array and issues with the session.save path directive. The impact and attack vectors of this issue are not explicitly specified.

Recommendations For PHP versions prior to 5.2.12, update to version 5.2.12 or later to resolve the issue.

Fix

Related Identifiers

CVE-2009-4143

DSA-2001-1

HPSBUX02543

Affected Products

Hp-Ux

Php

References · 33

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3291 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3292 · Security Note
• http://secunia.com/advisories/38648 · Vendor Advisory
• http://secunia.com/advisories/41490 · Vendor Advisory
• http://secunia.com/advisories/37821 · Vendor Advisory
• http://debian.org/security/2010/dsa-2001 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4143 · Security Note
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995 · Vendor Advisory
• http://vupen.com/english/advisories/2009/3593 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4143 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2010:045 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=127680701405735&w=2 · Vendor Advisory
• http://secunia.com/advisories/40262 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3293 · Security Note
• http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html · Vendor Advisory