CVE-2009-3557

2009-11-2300:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.007 Low

EPSS

Percentile

80.1%

JSON

The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x
before 5.3.1 allows context-dependent attackers to bypass safe_mode
restrictions, and create files in group-writable or world-writable
directories, via the dir and prefix arguments.

Notes

Author	Note
mdeslaur	safe_mode is not supported

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchphp5< 5.1.2-1ubuntu3.17UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.9UNKNOWN
ubuntu8.10noarchphp5< 5.2.6-2ubuntu4.5UNKNOWN
ubuntu9.04noarchphp5< 5.2.6.dfsg.1-3ubuntu4.4UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	php5	< 5.1.2-1ubuntu3.17	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.9	UNKNOWN
ubuntu	8.10	noarch	php5	< 5.2.6-2ubuntu4.5	UNKNOWN
ubuntu	9.04	noarch	php5	< 5.2.6.dfsg.1-3ubuntu4.4	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.3	UNKNOWN