CVE-2009-4023

🗓️ 28 Nov 2009 17:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 74 Views🌐 WEB

Argument injection vuln Mail::Send method (Mail/sendmail.php) in Mail 1.1.14 for PEAR, allows remote attackers to read & write arbitrary files via crafted $from param

Reporter	Title	Published	Views	Family All 31
Cvelist	CVE-2009-4023	28 Nov 200917:00	–	cvelist
Debian CVE	CVE-2009-4023	28 Nov 200917:00	–	debiancve
EUVD	EUVD-2009-3994	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 11 Update: php-pear-Mail-1.1.14-5.fc11	1 Dec 200904:20	–	fedora
Fedora	[SECURITY] Fedora 10 Update: php-pear-Mail-1.1.14-5.fc10	1 Dec 200904:41	–	fedora
Fedora	[SECURITY] Fedora 12 Update: php-pear-Mail-1.1.14-5.fc12	1 Dec 200904:29	–	fedora
Tenable Nessus	Fedora 11 : php-pear-Mail-1.1.14-5.fc11 (2009-12348)	1 Dec 200900:00	–	nessus
Tenable Nessus	Fedora 12 : php-pear-Mail-1.1.14-5.fc12 (2009-12395)	1 Dec 200900:00	–	nessus
Tenable Nessus	Fedora 10 : php-pear-Mail-1.1.14-5.fc10 (2009-12439)	1 Dec 200900:00	–	nessus
Tenable Nessus	GLSA-201412-09 : Multiple packages, Multiple vulnerabilities fixed in 2011	15 Dec 201400:00	–	nessus

NVD

Node

pear pearMatch1.1.14

Source	Link
lists	www.lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
openwall	www.openwall.com/lists/oss-security/2009/11/23/8
svn	www.svn.php.net/viewvc/pear/packages/Mail/trunk/Mail/sendmail.php
vupen	www.vupen.com/english/advisories/2009/3300
debian	www.debian.org/security/2009/dsa-1938
pear	www.pear.php.net/bugs/bug.php
securityfocus	www.securityfocus.com/bid/37081
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/54362
secunia	www.secunia.com/advisories/37410
pear	www.pear.php.net/bugs/bug.php

Parameter	Position	Path	Description	CWE
from	request body	Mail/sendmail.php	Argument injection vulnerability in the sendmail implementation via crafted from parameter in Mail/sendmail.php (Mail package 1.1.14), enabling read/write of arbitrary files.	CWE-94

23 Apr 2026 00:35Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

EPSS0.03135

CWE-94