Lucene search

[email protected]CVE-2006-0097

HistoryJan 06, 2006 - 11:03 a.m.

CVE-2006-0097

2006-01-0611:03:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2006-0097

buffer overflow

php

libmysql

windows

arbitrary code execution

named pipe

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.

Affected configurations

NVD

Node

phpphpMatch4.3.10

phpphpMatch4.4.0

phpphpMatch4.4.1

phpphpMatch4.4.2

CPENameOperatorVersion
php:phpphpeq4.3.10
php:phpphpeq4.4.0
php:phpphpeq4.4.1
php:phpphpeq4.4.2

CPE	Name	Operator	Version
php:php	php	eq	4.3.10
php:php	php	eq	4.4.0
php:php	php	eq	4.4.1
php:php	php	eq	4.4.2

References

archives.neohapsis.com/archives/fulldisclosure/2006-01/0274.html

lists.grok.org.uk/pipermail/full-disclosure/2006-January/041013.html

secunia.com/advisories/18275

www.osvdb.org/22232

www.php.net/ChangeLog-4.php#4.4.3

www.securityfocus.com/archive/1/420986/100/0/threaded

www.securityfocus.com/bid/16145

www.vupen.com/english/advisories/2006/0046

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8 High

AI Score

Confidence

High

0.019 Low

EPSS

Percentile

88.6%

JSON

Related for CVE-2006-0097

cvelist1 nvd1 redhatcve1 prion1