CVE-2012-2335

The record

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.

Affected packages

Related vulnerabilities

• CVE-2015-2331 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and… Also affects php5
• CVE-2015-2305 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library… Also affects php5
• CVE-2015-0235 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… Also affects php5
• CVE-2014-9427 sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and… Also affects php5
• CVE-2014-0185 sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and… Also affects php5
• CVE-2013-7345 The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file… Also affects php5
• CVE-2013-1643 The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to… Also affects php5
• CVE-2012-2688 Unspecified vulnerability in the _php_stream_scandir function in the stream… Also affects php5