CVE-2011-0754

The SplFileInfo::getType function in the Standard PHP Library SPL extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack...

Cross site scripting

The SplFileInfo::getType function in the Standard PHP Library SPL extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack...

CVE-2011-0754

The CVE affects PHP’s SPL extension (SplFileInfo::getType) prior to PHP 5.3.4 on Windows, where symbolic links are not detected due to the lack of FILE_ATTRIBUTE_REPARSE_POINT checking. This can enable local symlink attacks via cross-platform stat structure differences. Remediation: upgrade to PH...