CVE-2007-4850
- State
- Published
- Severity
- Not scored
- Published
- Jan 25, 2008
- Updated
- Aug 7, 2024
- Reserved
- Sep 12, 2007
Description
curl/interface.c in the cURL library (aka libcurl) in PHP 5.2.4 and 5.2.5 allows context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files via a file:// request containing a \x00 sequence, a different vulnerability than CVE-2006-2563.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- ADV-2008-1412vdb-entry
- APPLE-SA-2008-07-31vendor-advisory
- 31681vdb-entry
- 29009vdb-entry
- 27413vdb-entry
- ADV-2008-2268vdb-entry
- USN-628-1vendor-advisory
- 20080122 PHP 5.2.5 cURL safe_mode bypassmailing-list
- 20080122 PHP 5.2.5 cURL safe_mode bypassthird-party-advisory
- [oss-security] 20080502 CVE Request (PHP)mailing-list
- 20080527 rPSA-2008-0178-1 php php-mysql php-pgsqlmailing-list
- 30411third-party-advisory
- http://www.php.net/ChangeLog-5.php
- MDVSA-2009:023vendor-advisory
- MDVSA-2009:022vendor-advisory
- 31200third-party-advisory
- 32222third-party-advisory
- 20080122 PHP 5.2.5 cURL safe_mode bypassmailing-list
- 3562third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178
- 31326third-party-advisory
- ADV-2008-2780vdb-entry
- php-safemode-directive-security-bypass(42134)vdb-entry
- php-curlinit-security-bypass(39852)vdb-entry
- APPLE-SA-2008-10-09vendor-advisory
- http://support.apple.com/kb/HT3216
- http://cvs.php.net/viewcvs.cgi/php-src/NEWS?revision=1.2027.2.547.2.1047&view=markup
- 30048third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.