Upstream information
CVE-2008-5624 at MITRE
Description
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
SUSE information
Overall state of this security issue: Resolved
This issue is currently rated as having important severity.
CVSS v2 Scores
| NVD |
Base Score | 7.5 |
Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Access Vector | Network |
Access Complexity | Low |
Authentication | None |
Confidentiality Impact | Partial |
Integrity Impact | Partial |
Availability Impact | Partial |
SUSE Bugzilla entries:
557157 [RESOLVED / FIXED],
568527 [RESOLVED / FIXED]
SUSE Security Advisories:
List of released packages
Product(s) | Fixed package version(s) | References |
SUSE Linux Enterprise Server 11 SP1 | apache2-mod_php5 >= 5.2.6-50.24.1
php5 >= 5.2.6-50.24.1
php5-bcmath >= 5.2.6-50.24.1
php5-bz2 >= 5.2.6-50.24.1
php5-calendar >= 5.2.6-50.24.1
php5-ctype >= 5.2.6-50.24.1
php5-curl >= 5.2.6-50.24.1
php5-dba >= 5.2.6-50.24.1
php5-dbase >= 5.2.6-50.24.1
php5-dom >= 5.2.6-50.24.1
php5-exif >= 5.2.6-50.24.1
php5-fastcgi >= 5.2.6-50.24.1
php5-ftp >= 5.2.6-50.24.1
php5-gd >= 5.2.6-50.24.1
php5-gettext >= 5.2.6-50.24.1
php5-gmp >= 5.2.6-50.24.1
php5-hash >= 5.2.6-50.24.1
php5-iconv >= 5.2.6-50.24.1
php5-json >= 5.2.6-50.24.1
php5-ldap >= 5.2.6-50.24.1
php5-mbstring >= 5.2.6-50.24.1
php5-mcrypt >= 5.2.6-50.24.1
php5-mysql >= 5.2.6-50.24.1
php5-odbc >= 5.2.6-50.24.1
php5-openssl >= 5.2.6-50.24.1
php5-pcntl >= 5.2.6-50.24.1
php5-pdo >= 5.2.6-50.24.1
php5-pear >= 5.2.6-50.24.1
php5-pgsql >= 5.2.6-50.24.1
php5-pspell >= 5.2.6-50.24.1
php5-shmop >= 5.2.6-50.24.1
php5-snmp >= 5.2.6-50.24.1
php5-soap >= 5.2.6-50.24.1
php5-suhosin >= 5.2.6-50.24.1
php5-sysvmsg >= 5.2.6-50.24.1
php5-sysvsem >= 5.2.6-50.24.1
php5-sysvshm >= 5.2.6-50.24.1
php5-tokenizer >= 5.2.6-50.24.1
php5-wddx >= 5.2.6-50.24.1
php5-xmlreader >= 5.2.6-50.24.1
php5-xmlrpc >= 5.2.6-50.24.1
php5-xmlwriter >= 5.2.6-50.24.1
php5-xsl >= 5.2.6-50.24.1
php5-zip >= 5.2.6-50.24.1
php5-zlib >= 5.2.6-50.24.1
| Patchnames: SUSE Linux Enterprise Server 11 SP1 GA apache2-mod_php5-5.2.6-50.24.1 |
SUSE Linux Enterprise Server 11 SP2 | apache2-mod_php5 >= 5.2.14-0.7.24.1
php5 >= 5.2.14-0.7.24.1
php5-bcmath >= 5.2.14-0.7.24.1
php5-bz2 >= 5.2.14-0.7.24.1
php5-calendar >= 5.2.14-0.7.24.1
php5-ctype >= 5.2.14-0.7.24.1
php5-curl >= 5.2.14-0.7.24.1
php5-dba >= 5.2.14-0.7.24.1
php5-dbase >= 5.2.14-0.7.24.1
php5-dom >= 5.2.14-0.7.24.1
php5-exif >= 5.2.14-0.7.24.1
php5-fastcgi >= 5.2.14-0.7.24.1
php5-ftp >= 5.2.14-0.7.24.1
php5-gd >= 5.2.14-0.7.24.1
php5-gettext >= 5.2.14-0.7.24.1
php5-gmp >= 5.2.14-0.7.24.1
php5-hash >= 5.2.14-0.7.24.1
php5-iconv >= 5.2.14-0.7.24.1
php5-json >= 5.2.14-0.7.24.1
php5-ldap >= 5.2.14-0.7.24.1
php5-mbstring >= 5.2.14-0.7.24.1
php5-mcrypt >= 5.2.14-0.7.24.1
php5-mysql >= 5.2.14-0.7.24.1
php5-odbc >= 5.2.14-0.7.24.1
php5-openssl >= 5.2.14-0.7.24.1
php5-pcntl >= 5.2.14-0.7.24.1
php5-pdo >= 5.2.14-0.7.24.1
php5-pear >= 5.2.14-0.7.24.1
php5-pgsql >= 5.2.14-0.7.24.1
php5-pspell >= 5.2.14-0.7.24.1
php5-shmop >= 5.2.14-0.7.24.1
php5-snmp >= 5.2.14-0.7.24.1
php5-soap >= 5.2.14-0.7.24.1
php5-suhosin >= 5.2.14-0.7.24.1
php5-sysvmsg >= 5.2.14-0.7.24.1
php5-sysvsem >= 5.2.14-0.7.24.1
php5-sysvshm >= 5.2.14-0.7.24.1
php5-tokenizer >= 5.2.14-0.7.24.1
php5-wddx >= 5.2.14-0.7.24.1
php5-xmlreader >= 5.2.14-0.7.24.1
php5-xmlrpc >= 5.2.14-0.7.24.1
php5-xmlwriter >= 5.2.14-0.7.24.1
php5-xsl >= 5.2.14-0.7.24.1
php5-zip >= 5.2.14-0.7.24.1
php5-zlib >= 5.2.14-0.7.24.1
| Patchnames: SUSE Linux Enterprise Server 11 SP2 GA apache2-mod_php5-5.2.14-0.7.24.1 |
SUSE Timeline for this CVE
CVE page created: Fri Jun 28 07:09:17 2013
CVE page last modified: Mon Sep 9 17:05:45 2024