PT-2010-4822 · Php · Php

Published 2010-11-08 · Updated 2024-06-15 · CVE-2010-3436

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions PHP versions 5.3.x through 5.3.3

Description The issue allows remote attackers to bypass open basedir restrictions via vectors related to the length of a filename. This is related to the fopen wrappers.c in PHP.

Recommendations For PHP versions 5.3.x through 5.3.3, consider updating to a version where this issue is resolved, as the current version may allow remote attackers to bypass security restrictions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-3436

OPENSUSE-SU-2024:10290-1

OPENSUSE-SU-2024:10344-1

OPENSUSE-SU-2024:11169-1

Affected Products

Php

References · 140

• https://osv.dev/vulnerability/openSUSE-SU-2024:10344-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11169-1 · Vendor Advisory
• http://php.net/ChangeLog-5.php · Vendor Advisory
• http://svn.php.net/viewvc?view=revision&revision=303824 · Vendor Advisory
• http://php.net/archive/2010.php#id2010-12-10-1 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.490619 · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3436 · Security Note
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html · Vendor Advisory
• http://svn.php.net/viewvc/php/php-src/trunk/main/fopen_wrappers.c?r1=303824&r2=303823&pathrev=303824 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10290-1 · Vendor Advisory
• http://php.net/releases/5_3_4.php · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2010:218 · Vendor Advisory
• http://php.net/releases/5_2_15.php · Vendor Advisory