CVE-2008-2666
- State
- Published
- Severity
- Not scored
- Published
- Jun 20, 2008
- Updated
- Aug 7, 2024
- Reserved
- Jun 10, 2008
Description
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 32746third-party-advisory
- HPSBUX02465vendor-advisory
- http://support.apple.com/kb/HT3549
- 3942third-party-advisory
- GLSA-200811-05vendor-advisory
- SSRT090085vendor-advisory
- 20090302 rPSA-2009-0035-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xslmailing-list
- http://wiki.rpath.com/Advisories:rPSA-2009-0035
- 29796vdb-entry
- 35074third-party-advisory
- APPLE-SA-2009-05-12vendor-advisory
- php-chdir-ftoc-security-bypass(43198)vdb-entry
- TA09-133Athird-party-advisory
- ADV-2009-1297vdb-entry
- 1020328vdb-entry
- 35650third-party-advisory
- 20080617 PHP 5.2.6 chdir(),ftok() (standard ext) safe_mode bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.