CVE-2011-2202
Publication date 16 June 2011
Last updated 24 July 2024
Ubuntu priority
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
Status
Package | Ubuntu Release | Status |
---|---|---|
php5 | ||
Notes
Patch details
Package | Patch details |
---|---|
php5 |
References
Related Ubuntu Security Notices (USN)
- USN-1231-1
- PHP Vulnerabilities
- 18 October 2011