CVE-2009-4023

Argument injection vulnerability in the sendmail implementation of the Mail::Send method Mail/sendmail.php in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111...

CVE-2009-4024

Argument injection vulnerability in the ping function in Ping.php in the NetPing package before 2.4.5 for PEAR allows remote attackers to execute arbitrary shell commands via the host parameter. NOTE: this has also been reported as a shell metacharacter problem...

CVE-2009-4023

Summary: CVE-2009-4023 (with CVE-2009-4111) affects the Mail::Send implementation in PEAR Mail’s sendmail.php for the Mail package, version 1.1.14. A crafted $from parameter allows remote attackers to read and write arbitrary files over the network. The vulnerability is classified with base CVSS ...

[SECURITY] Fedora 11 Update: php-pear-Net-Ping-2.4.5-1.fc11

OS independent wrapper class for executing ping calls...

[SECURITY] Fedora 12 Update: php-pear-Net-Ping-2.4.5-1.fc12

OS independent wrapper class for executing ping calls...

[SECURITY] Fedora 10 Update: php-pear-Net-Traceroute-0.21.2-1.fc10

OS independent wrapper class for executing traceroute calls...

[SECURITY] Fedora 11 Update: php-pear-Net-Traceroute-0.21.2-1.fc11

OS independent wrapper class for executing traceroute calls...

[SECURITY] [DSA 1938-1] New php-mail packages fix insufficient input sanitising

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1938-1 [email protected] http://www.debian.org/security/ Steffen Joeris November 23, 2009 http://www.debian.org/security/faq -...

PEAR Net_Traceroute 'traceroute()'函数任意变量注入漏洞

Bugraq ID: 37094 PEAR NetTraceroute是一款基于PHP的执行路由跟踪的OS独立封装类。 当表单输入直接使用时，攻击者可以传递变量允许执行远程任意命令注入攻击。 PEAR NetTraceroute 0.21.1 PEAR NetTraceroute-0.21.2已经修复此漏洞，建议用户下载使用： http://download.pear.php.net/package/NetTraceroute-0.21.2.tgz pear upgrade NetTraceroute-0.21.2...

PEAR Net_Ping 'ping()'函数任意变量注入漏洞

Bugraq ID: 37093 PEAR NetPing是一款基于PHP的执行ping操作的OS独立封装类。 当表单输入直接使用时，攻击者可以传递变量允许执行远程任意命令注入攻击。 PEAR NetPing 2.4.4 PEAR NetPing 2.4.5已经修复此漏洞，建议用户下载使用： http://download.pear.php.net/package/NetPing-2.4.5.tgz pear upgrade NetPing-2.4.5...

PEAR Mail软件包Sendmail Mail::Send()方式参数注入漏洞

BUGTRAQ ID: 37081 PEAR是“PHP扩展和应用库”的缩写，用于为PHP用户提供结构化的开源代码库。 PEAR的Mail软件包中sendmail实现没有正确地过滤对Mail::Send方式所提交的from参数，远程攻击者可以向sendmail命令传送任意参数，绕过安全限制获取任意文件的内容。 PEAR Mail 1.1.4 厂商补丁： PEAR ---- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

[SECURITY] [DSA 1938-1] New php-mail packages fix insufficient input sanitising

------------------------------------------------------------------------ Debian Security Advisory DSA-1938-1 [email protected] http://www.debian.org/security/ Steffen Joeris November 23, 2009 http://www.debian.org/security/faq -...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES11: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-dom php5-exif php5-fastcgi php5-ftp php5-gd php5-gettex...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES10: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-devel php5-dom php5-exif php5-fastcgi php5-ftp php5-gd...

SLES11: Security update for PHP5

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: apache2-modphp5 php5 php5-bcmath php5-bz2 php5-calendar php5-ctype php5-curl php5-dba php5-dbase php5-dom php5-exif php5-fastcgi php5-ftp php5-gd php5-gettex...