CVE-2010-3436

2010-11-0800:00:00

ubuntu.com

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.006 Low

EPSS

Percentile

77.5%

JSON

fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to
bypass open_basedir restrictions via vectors related to the length of a
filename.

Bugs

Notes

Author	Note
mdeslaur	open_basedir bypass, this is low
sbeattie	upstream patch introduced the regression in LP: #701765 a second regression http://bugs.php.net/bug.php?id=53597, is actually an intended upstream behavior change.

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchphp5< 5.1.2-1ubuntu3.20UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.13UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.6UNKNOWN
ubuntu10.04noarchphp5< 5.3.2-1ubuntu4.6UNKNOWN
ubuntu10.10noarchphp5< 5.3.3-1ubuntu9.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	php5	< 5.1.2-1ubuntu3.20	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.13	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.6	UNKNOWN
ubuntu	10.04	noarch	php5	< 5.3.2-1ubuntu4.6	UNKNOWN
ubuntu	10.10	noarch	php5	< 5.3.3-1ubuntu9.2	UNKNOWN