SB2018103065 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018103065

SB2018103065 - Multiple vulnerabilities in PHP

Published: October 30, 2018 Updated: June 8, 2025

Security Bulletin ID SB2018103065
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2006-2660)

The vulnerability allows a local user to corrupt data.

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2001-1247)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.


Remediation

Install update from vendor's website.

References