CVE-2008-0599
Critical · 9.8CVSS
9.8
EPSS
10.9%
Published
May 5, 2008
CISA due date
—
The record
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:5.0 | php5 | 0 | 5.2.5-3+lenny1 |
| Red Hat:rhel_application_stack:2 | httpd | 0 | 0:2.2.8-1.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-debuginfo | 0 | 0:2.2.8-1.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-devel | 0 | 0:2.2.8-1.el5s2 |
| Red Hat:rhel_application_stack:2 | httpd-manual | 0 | 0:2.2.8-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_jk | 0 | 0:1.2.26-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_jk-ap20 | 0 | 0:1.2.26-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_jk-debuginfo | 0 | 0:1.2.26-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_perl | 0 | 0:2.0.4-3.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_perl-debuginfo | 0 | 0:2.0.4-3.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_perl-devel | 0 | 0:2.0.4-3.el5s2 |
| Red Hat:rhel_application_stack:2 | mod_ssl | 0 | 1:2.2.8-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-bench | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-cluster | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-connector-odbc | 0 | 0:3.51.24r1071-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-connector-odbc-debuginfo | 0 | 0:3.51.24r1071-1.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-debuginfo | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-devel | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-jdbc | 0 | 0:5.0.8-1jpp.1.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-libs | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-server | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | mysql-test | 0 | 0:5.0.50sp1a-2.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBD-MySQL | 0 | 0:4.006-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBD-MySQL-debuginfo | 0 | 0:4.006-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBI | 0 | 0:1.604-1.el5s2 |
| Red Hat:rhel_application_stack:2 | perl-DBI-debuginfo | 0 | 0:1.604-1.el5s2 |
| Red Hat:rhel_application_stack:2 | php | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-bcmath | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-cli | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-common | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-dba | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-debuginfo | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-devel | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-gd | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-imap | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-ldap | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-mbstring | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-mysql | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-ncurses | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-odbc | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-pdo | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-pgsql | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-snmp | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-soap | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-xml | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | php-xmlrpc | 0 | 0:5.2.6-2.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-contrib | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-debuginfo | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-devel | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-docs | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-jdbc | 0 | 0:8.2.508-1jpp.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-jdbc-debuginfo | 0 | 0:8.2.508-1jpp.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-libs | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-odbc | 0 | 0:08.02.0500-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-odbc-debuginfo | 0 | 0:08.02.0500-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-plperl | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-plpython | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-pltcl | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-python | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-server | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-tcl | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresql-test | 0 | 0:8.2.9-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresqlclient81 | 0 | 0:8.1.11-1.el5s2 |
| Red Hat:rhel_application_stack:2 | postgresqlclient81-debuginfo | 0 | 0:8.1.11-1.el5s2 |
| Red Hat:rhel_application_stack:2 | unixODBC | 0 | 0:2.2.12-8.el5s2 |
| Red Hat:rhel_application_stack:2 | unixODBC-debuginfo | 0 | 0:2.2.12-8.el5s2 |
| Red Hat:rhel_application_stack:2 | unixODBC-devel | 0 | 0:2.2.12-8.el5s2 |
| Red Hat:rhel_application_stack:2 | unixODBC-kde | 0 | 0:2.2.12-8.el5s2 |
| openSUSE:Tumbleweed | php7 | 0 | 7.4.24-1.1 |
| openSUSE:Tumbleweed | php8 | 0 | 8.0.11-1.1 |
Related vulnerabilities
- CVE-2012-0830 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote… Also affects php5
- CVE-2011-4885 PHP before 5.3.9 computes hash values for form parameters without restricting the ability… Also affects php5
- CVE-2011-2202 The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly… Also affects php5
- CVE-2011-1938 Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in… Also affects php5
- CVE-2011-1471 Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows… Also affects php5
- CVE-2011-0421 The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before… Also affects php5
- CVE-2011-0420 The grapheme_extract function in the Internationalization extension (Intl) for ICU for… Also affects php5
- CVE-2010-3870 The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form… Also affects php5