Published: 03/03/2009 Updated: 03/10/2018

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 215

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.

Vulnerable Product	Search on Vulmon	Subscribe to Product
php php 5.1.6
php php 4.4.4

Synopsis Moderate: php security update Type/Severity Security Advisory: Moderate Topic Updated php packages that fix several security issues are now available forRed Hat Enterprise Linux 5This update has been rated as having moderate security impact by the RedHat Security Response Team Descriptio ...

It was discovered that PHP did not sanitize certain error messages when display_errors is enabled, which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attac ...

Debian Bug report logs - #523028 CVE-2008-5814: XSS vulnerability in PHP <= 527 Package: php5; Maintainer for php5 is Debian PHP Maintainers <pkg-php-maint@listsaliothdebianorg>; Source for php5 is src:php5 (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> Date: Tue, 7 Apr ...

Debian Bug report logs - #523049 CVE-2009-0754: mbstringfunc_overload setting leakage across vhosts Package: php5; Maintainer for php5 is Debian PHP Maintainers <pkg-php-maint@listsaliothdebianorg>; Source for php5 is src:php5 (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom> D ...

Several remote vulnerabilities have been discovered in the PHP 5 hypertext preprocessor The Common Vulnerabilities and Exposures project identifies the following problems The following four vulnerabilities have already been fixed in the stable (lenny) version of php5 prior to the release of lenny This update now addresses them for etch (oldstab ...

source: wwwsecurityfocuscom/bid/33542/info PHP is prone to a denial-of-service vulnerability because it fails to limit global scope for certain settings relating to Unicode text operations Attackers can exploit this issue to crash the affected webserver, denying service to legitimate users <?php $v = 'Òîâà å òåñò| ...

CWE-134 http://bugs.php.net/bug.php?id=27421 http://www.openwall.com/lists/oss-security/2009/02/03/3 http://www.openwall.com/lists/oss-security/2009/02/25/3 http://www.openwall.com/lists/oss-security/2009/01/30/1 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://secunia.com/advisories/34642 http://www.securitytracker.com/id?1021979 http://www.redhat.com/support/errata/RHSA-2009-0350.html http://secunia.com/advisories/34830 http://www.debian.org/security/2009/dsa-1789 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35306 https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035 https://usn.ubuntu.com/761-1/https://access.redhat.com/errata/RHSA-2009:0338 https://usn.ubuntu.com/761-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/32769/

CVE-2009-0754

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect