PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
References
Link | Resource |
---|---|
http://online.securityfocus.com/archive/1/194425 | Broken Link Third Party Advisory VDB Entry |
http://www.iss.net/security_center/static/6787.php | Broken Link Patch Vendor Advisory |
http://www.php.net/do_download.php?download_file=php-4.1.2.tar.gz | Broken Link |
http://www.redhat.com/support/errata/RHSA-2002-102.html | Broken Link |
http://www.redhat.com/support/errata/RHSA-2002-129.html | Broken Link |
http://www.redhat.com/support/errata/RHSA-2003-159.html | Broken Link |
http://www.securityfocus.com/bid/2954 | Broken Link Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2002-06-25T04:00:00
Updated: 2010-01-22T00:00:00
Reserved: 2002-05-01T00:00:00
Link: CVE-2001-1246
JSON object: View
NVD Information
Status : Analyzed
Published: 2001-06-30T04:00:00.000
Modified: 2024-02-14T15:17:03.503
Link: CVE-2001-1246
JSON object: View
Redhat Information
No data.
CWE