PT-2011-2608 · Php · Php

Published 2011-02-02 · Updated 2018-10-30 · CVE-2011-0752

NVD

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

The extract function in PHP before 5.2.15 does not prevent use of the EXTR OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0752

Affected Products

Php

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2011-0752 · Security Note
• http://marc.info/?l=bugtraq&m=133469208622507&w=2 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65432 · Note
• http://openwall.com/lists/oss-security/2010/12/13/4 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0752 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12016 · Note
• http://php.net/archive/2010.php#id2010-12-10-1 · Note
• http://php.net/releases/5_2_15.php · Note
• http://php.net/ChangeLog-5.php · Note