Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| http://secunia.com/advisories/21723 | third-party-advisory x_refsource_SECUNIA x_transferred |
| https://issues.rpath.com/browse/RPL-683 | x_refsource_CONFIRM x_transferred |
| http://secunia.com/advisories/19775 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/21252 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/21202 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://securityreason.com/securityalert/677 | third-party-advisory x_refsource_SREASON x_transferred |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/25705 | vdb-entry x_refsource_XF x_transferred |
| http://www.vupen.com/english/advisories/2006/1290 | vdb-entry x_refsource_VUPEN x_transferred |
| http://www.redhat.com/support/errata/RHSA-2006-0568.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://secunia.com/advisories/21135 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.ubuntu.com/usn/usn-320-1 | vendor-advisory x_refsource_UBUNTU x_transferred |
| http://www.securityfocus.com/archive/1/447866/100/0/threaded | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://secunia.com/advisories/19979 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://rhn.redhat.com/errata/RHSA-2006-0549.html | vendor-advisory x_refsource_REDHAT x_transferred |
| http://secunia.com/advisories/22225 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/21125 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://secunia.com/advisories/19599 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://www.mandriva.com/security/advisories?name=MDKSA-2006:074 | vendor-advisory x_refsource_MANDRIVA x_transferred |
| http://securityreason.com/achievement_securityalert/36 | third-party-advisory x_refsource_SREASONRES x_transferred |
| http://secunia.com/advisories/21031 | third-party-advisory x_refsource_SECUNIA x_transferred |
| http://securitytracker.com/id?1015881 | vdb-entry x_refsource_SECTRACK x_transferred |
| http://www.redhat.com/support/errata/RHSA-2006-0567.html | vendor-advisory x_refsource_REDHAT x_transferred |
| ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U | vendor-advisory x_refsource_SGI x_transferred |
| http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm | x_refsource_CONFIRM x_transferred |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10196 | vdb-entry signature x_refsource_OVAL x_transferred |
| http://www.securityfocus.com/bid/17439 | vdb-entry x_refsource_BID x_transferred |
| http://www.novell.com/linux/security/advisories/05-05-2006.html | vendor-advisory x_refsource_SUSE x_transferred |
Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 2.6 | LOW | AV:N/AC:H/Au:N/C:N/I:P/A:N |
| CWE ID | Type | Source |
|---|---|---|
| NVD-CWE-Other | Primary | nvd@nist.gov |
This issue did not affect the versions of OpenSSH as distributed with Red Hat Enterprise Linux 2.1, 3, or 4.
CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.
Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.
Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208.