CVE-2004-1392

The record

PHP 4.0 with cURL functions allows remote attackers to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Affected packages

Related vulnerabilities

• CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php
• CVE-2009-3546 The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD… Also affects php
• CVE-2007-1825 Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before… Also affects php
• CVE-2007-1286 Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to… Also affects php
• CVE-2007-1285 The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to… Also affects php
• CVE-2007-0908 The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5… Also affects php
• CVE-2007-0455 Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33… Also affects php
• CVE-2006-1990 Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow… Also affects php