Lucene search
Ubuntu.comUB:CVE-2015-2348HistoryMar 30, 2015 - 12:00 a.m.
CVE-2015-2348
2015-03-3000:00:00
ubuntu.com
ubuntu.com
30
php
remote attackers
file extension restrictions
remote code execution
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
0.008
Percentile
82.4%
The move_uploaded_file implementation in ext/standard/basic_functions.c in
PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a
pathname upon encountering a \x00 character, which allows remote attackers
to bypass intended extension restrictions and create files with unexpected
names via a crafted second argument. NOTE: this vulnerability exists
because of an incomplete fix for CVE-2006-7243.
Bugs
Notes
| Author | Note |
|---|---|
| mdeslaur | fixed in lucidโs php5-CVE-2006-7243.patch, and is fixed in precise also. Seems to be a regression in 5.4+ |
Related
cvelist
cvelist
nvd
nvd
prion
prion
Information disclosure
2015-03-30 10:59:00
Design/Logic Flaw
2015-06-09 18:59:00
Code injection
2015-06-09 18:59:00
cve
cve
nessus
nessus
Debian DLA-444-1 : php5 security update
2016-03-01 00:00:00
FreeBSD : php -- NULL byte poisoning (3761df02-0f9c-11e0-becc-0022156e8794)
2011-01-13 00:00:00
Scientific Linux Security Update : php on SL5.x i386/x86_64 (20140318)
2014-03-20 00:00:00
debian
debian
[SECURITY] [DLA 444-1] php5 security update
2016-02-29 18:41:39
[SECURITY] [DLA 307-1] php5 security update
2015-09-07 20:21:46
osv
osv
php5 - security update
2016-02-29 00:00:00
Red Hat Security Advisory: php security update
2024-09-15 20:49:48
Red Hat Security Advisory: php security, bug fix, and enhancement update
2024-09-15 20:49:37
openvas
openvas
Debian: Security Advisory (DLA-444-1)
2023-03-08 00:00:00
FreeBSD Ports: php5
2011-01-24 00:00:00
FreeBSD Ports: php5
2011-01-24 00:00:00
ubuntucve
ubuntucve
veracode
veracode
Authorization Bypass
2019-01-15 08:51:41
Use-After-Free
2019-05-02 05:39:23
Null Pointer Dereference
2019-05-02 05:39:23
seebug
seebug
PHP็ฉบๅญ็ฌฆๅฎๅ
จ้ๅถ็ป่ฟๆผๆด(CVE-2006-7243)
2012-04-12 00:00:00
PHPๅค็ๆฌ๏ผ5.2,5.4.38~5.6.6๏ผไปปๆๆไปถไธไผ ๆผๆด
2015-10-10 00:00:00
freebsd
freebsd
php -- NULL byte poisoning
2010-12-10 00:00:00
php -- multiple vulnerabilities
2015-05-14 00:00:00
oraclelinux
oraclelinux
php security update
2014-03-18 00:00:00
php security, bug fix, and enhancement update
2013-11-25 00:00:00
php53 security, bug fix and enhancement update
2013-10-02 00:00:00
redhat
redhat
(RHSA-2014:0311) Critical: php security update
2014-03-18 00:00:00
(RHSA-2013:1615) Moderate: php security, bug fix, and enhancement update
2013-11-21 00:00:00
(RHSA-2013:1307) Moderate: php53 security, bug fix and enhancement update
2013-09-30 16:52:28
thn
thn
Seagate NAS Zero-Day Vulnerability allows Unauthorized Root Access Remotely
2015-03-01 00:50:00
redhatcve
redhatcve
CVE-2019-11044
2020-03-28 20:00:41
centos
centos
php security update
2014-03-19 01:15:26
php security update
2013-11-26 13:32:36
php53 security update
2013-10-07 12:42:03
f5
f5
K16993 : PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026
2015-07-22 00:00:00
SOL16993 - PHP vulnerabilities CVE-2015-4025 and CVE-2015-4026
2015-07-22 00:00:00
K13519 : Multiple PHP vulnerabilities
2013-09-20 00:00:00
fedora
fedora
[SECURITY] Fedora 22 Update: php-5.6.9-1.fc22
2015-05-26 03:40:42
[SECURITY] Fedora 21 Update: php-5.6.9-1.fc21
2015-05-27 16:13:20
[SECURITY] Fedora 20 Update: php-5.5.25-1.fc20
2015-05-27 16:23:41
ubuntu
ubuntu
PHP vulnerabilities
2015-04-20 00:00:00
PHP Regressions
2011-05-05 00:00:00
PHP vulnerabilities
2011-04-29 00:00:00
openwrt
openwrt
php: Security update (7 CVEs)
2016-01-28 12:23:45
slackware
slackware
[slackware-security] php
2015-06-11 23:01:25
suse
suse
Security update for php5 (important)
2015-05-13 15:07:04
kaspersky
kaspersky
KLA10514 Multiple vulnerabilities in PHP and plugins
2015-03-30 00:00:00
securityvulns
securityvulns
[USN-1126-1] PHP vulnerabilities
2011-05-01 00:00:00
PHP multiple security vulnerabilities
2011-05-01 00:00:00
cloudlinux
cloudlinux
Fix of 227 CVE
2020-10-15 12:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS
0.008
Percentile
82.4%
Related for UB:CVE-2015-2348