CVE-2011-0754

State: Published
Severity: Not scored
Published: Feb 2, 2011
Updated: Aug 6, 2024
Reserved: Feb 2, 2011

Description

The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

http://bugs.php.net/51763
php-splfileinfogettype-symlink(65429)vdb-entry
http://www.php.net/ChangeLog-5.php
oval:org.mitre.oval:def:12334vdb-entrysignature

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.