CVE-2009-4143

2009-12-2100:00:00

ubuntu.com

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.015 Low

EPSS

Percentile

86.5%

JSON

PHP before 5.2.12 does not properly handle session data, which has
unspecified impact and attack vectors related to (1) interrupt corruption
of the SESSION superglobal array and (2) the session.save_path directive.

Bugs

<https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-4143>

Notes

Author	Note
mdeslaur	safe_mode or open_basedir bypass

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchphp5< 5.1.2-1ubuntu3.18UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.10UNKNOWN
ubuntu8.10noarchphp5< 5.2.6-2ubuntu4.6UNKNOWN
ubuntu9.04noarchphp5< 5.2.6.dfsg.1-3ubuntu4.5UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	php5	< 5.1.2-1ubuntu3.18	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.10	UNKNOWN
ubuntu	8.10	noarch	php5	< 5.2.6-2ubuntu4.6	UNKNOWN
ubuntu	9.04	noarch	php5	< 5.2.6.dfsg.1-3ubuntu4.5	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.4	UNKNOWN