CVE-2009-1272

2009-04-0818:30:00

CWE-20

[email protected]

web.nvd.nist.gov

php

zip

denial of service

cve-2009-1272

security vulnerability

6.1 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.016 Low

EPSS

Percentile

87.1%

JSON

The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.

CPENameOperatorVersion
php:phpphpeq5.2.4
php:phpphpeq5.2.7
php:phpphpeq5.2.2
php:phpphpeq5.2.5
php:phpphpeq5.2.6
php:phpphpeq5.2.3
php:phpphpeq5.2.0
php:phpphpeq5.2.1
php:phpphpeq5.2.8

CPE	Name	Operator	Version
php:php	php	eq	5.2.4
php:php	php	eq	5.2.7
php:php	php	eq	5.2.2
php:php	php	eq	5.2.5
php:php	php	eq	5.2.6
php:php	php	eq	5.2.3
php:php	php	eq	5.2.0
php:php	php	eq	5.2.1
php:php	php	eq	5.2.8