Lucene search
Ubuntu.comUB:CVE-2011-2202HistoryJun 16, 2011 - 12:00 a.m.
CVE-2011-2202
2011-06-1600:00:00
ubuntu.com
ubuntu.com
16
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS
0.055
Percentile
93.2%
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7
does not properly restrict filenames in multipart/form-data POST requests,
which allows remote attackers to conduct absolute path traversal attacks,
and possibly create or overwrite arbitrary files, via a crafted upload
request, related to a “file path injection vulnerability.”
Bugs
- <https://bugs.launchpad.net/ubuntu/oneiric/+source/php5/+bug/813115>
- <http://bugs.php.net/bug.php?id=54939>
Notes
| Author | Note |
|---|---|
| mdeslaur | PoC: http://pastebin.com/1edSuSVN |
Related
exploitdb
exploitdb
PHP 5.3.6 - Security Bypass
2011-06-14 00:00:00
securityvulns
securityvulns
PHP directory traversal
2011-07-06 00:00:00
[slackware-security] php (SSA:2011-237-01)
2011-08-27 00:00:00
PHP multiple security vulnerabilities
2011-08-27 00:00:00
openvas
openvas
PHP SAPI_POST_HANDLER_FUNC() Security Bypass Vulnerability - Windows
2011-07-01 00:00:00
Slackware: Security Advisory (SSA:2011-237-01)
2012-09-10 00:00:00
Slackware Advisory SSA:2011-237-01 php
2012-09-10 00:00:00
nvd
nvd
CVE-2011-2202
2011-06-16 23:55:04
veracode
veracode
Arbitrary File Overwrite
2020-04-10 01:03:26
cve
cve
CVE-2011-2202
2011-06-16 23:55:04
prion
prion
Path traversal
2011-06-16 23:55:00
cvelist
cvelist
CVE-2011-2202
2011-06-16 23:00:00
nessus
nessus
freebsd
freebsd
php -- multiple vulnerabilities
2011-08-18 00:00:00
slackware
slackware
[slackware-security] php
2011-08-25 16:35:35
fedora
fedora
[SECURITY] Fedora 15 Update: php-5.3.8-1.fc15
2011-09-18 23:00:38
[SECURITY] Fedora 14 Update: php-eaccelerator-0.9.6.1-9.fc14
2011-09-18 22:59:22
[SECURITY] Fedora 16 Update: php-eaccelerator-0.9.6.1-9.fc16
2011-09-09 17:13:35
redhat
redhat
(RHSA-2012:0071) Moderate: php security update
2012-01-30 00:00:00
(RHSA-2012:0033) Moderate: php security update
2012-01-18 00:00:00
(RHSA-2011:1423) Moderate: php53 and php security update
2011-11-02 00:00:00
centos
centos
php security update
2012-01-30 20:44:11
php security update
2012-01-18 19:55:58
php53 security update
2011-11-03 03:59:22
oraclelinux
oraclelinux
php security update
2012-01-30 00:00:00
php security update
2012-01-18 00:00:00
php53 and php security update
2011-11-02 00:00:00
amazon
amazon
Important: php
2011-10-11 00:07:00
debian
debian
[SECURITY] [DSA 2266-1] php5 security update
2011-06-29 18:42:45
[SECURITY] [DSA 2262-2] php5 update
2011-07-01 20:00:32
ubuntu
ubuntu
PHP Vulnerabilities
2011-10-18 00:00:00
osv
osv
php5 - several
2011-06-29 00:00:00
apache2-mod_php5-5.6.28-1.1 on GA media
2024-06-15 00:00:00
apache2-mod_php7-7.0.14-1.4 on GA media
2024-06-15 00:00:00
suse
suse
Security update for PHP5 (important)
2012-04-12 23:08:15
Security update for PHP5 (important)
2013-08-16 21:04:11
gentoo
gentoo
PHP: Multiple vulnerabilities
2011-10-10 00:00:00
CVSS2
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:P/A:P
EPSS
0.055
Percentile
93.2%
Related for UB:CVE-2011-2202