CVE-2009-4018

CVE-2009-4018 affects PHP before 5.2.11 and 5.3.x before 5.3.1, where proc_open in ext/standard/proc_open.c fails to enforce safe_mode_allowed_env_vars and safe_mode_protected_env_vars. This lets context-dependent attackers supply an arbitrary environment via the env parameter, demonstrated by cr...

CVE-2009-4018: Undefined Security Weakness

The procopen function in ext/standard/procopen.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the 1 safemodeallowedenvvars and 2 safemodeprotectedenvvars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, a...