CVE-2010-2094
Published: 27 May 2010
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
Notes
| Author | Note |
|---|---|
| mdeslaur | 5.3 only, not fixed in 5.3.3 This is MOPS-2010-024 to MOPS-2010-028 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
(5.1.2-1ubuntu3.18)
|
| hardy |
Not vulnerable
(5.2.4-2ubuntu5.10)
|
|
| jaunty |
Not vulnerable
(5.2.6.dfsg.1-3ubuntu4.5)
|
|
| karmic |
Not vulnerable
(5.2.10.dfsg.1-2ubuntu6.4)
|
|
| lucid |
Released
(5.3.2-1ubuntu4.5)
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://svn.php.net/viewvc?view=revision&revision=298667 upstream: http://svn.php.net/viewvc?view=revision&revision=302565 |
||
References
- http://php-security.org/2010/05/14/mops-2010-024-php-phar_stream_flush-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-025-php-phar_wrapper_open_dir-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-026-php-phar_wrapper_unlink-format-string-vulnerability/index.html
- http://php-security.org/2010/05/14/mops-2010-027-php-phar_parse_url-format-string-vulnerabilities/index.html
- http://php-security.org/2010/05/14/mops-2010-028-php-phar_wrapper_open_url-format-string-vulnerabilities/index.html
- https://ubuntu.com/security/notices/USN-989-1
- https://www.cve.org/CVERecord?id=CVE-2010-2094
- NVD
- Launchpad
- Debian