CVEvulnerability

CVE-2008-0599

9.8 CRITICAL Published 2008-05-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-05-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-131

Description

The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

Affected configurations

• php php (< 5.2.6) • fedoraproject fedora 8 • fedoraproject fedora 9 • canonical ubuntu linux 6.06 • canonical ubuntu linux 7.04 • canonical ubuntu linux 7.10 • canonical ubuntu linux 8.04 • apple mac os x (< 10.5.4) • apple mac os x server (< 10.5.4)

Related

Weakness · CWE (1)

  • CWE-131 Incorrect Calculation of Buffer Size weakness

Referenced by CWE · observed example (2)

  • CWE-131 Incorrect Calculation of Buffer Size weakness
  • CWE-783 Operator Precedence Logic Error weakness

References