CVEvulnerability
CVE-2009-4111
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-11-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients parameter, and possibly other parameters, a different vulnerability than CVE-2009-4023.
Affected configurations
• pear mail 1.1.14
• pear mail 1.2.0b2
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html lists.opensuse.org
- http://pear.php.net/bugs/bug.php?id=16200 Exploit, Vendor Advisory
- http://secunia.com/advisories/37458 secunia.com
- http://www.debian.org/security/2009/dsa-1938 www.debian.org
- http://www.openwall.com/lists/oss-security/2009/11/23/8 www.openwall.com
- http://www.openwall.com/lists/oss-security/2009/11/28/2 www.openwall.com
- http://www.securityfocus.com/bid/37395 www.securityfocus.com
- https://bugs.gentoo.org/show_bug.cgi?id=294256 bugs.gentoo.org
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html lists.opensuse.org
- http://pear.php.net/bugs/bug.php?id=16200 Exploit, Vendor Advisory
- http://secunia.com/advisories/37458 secunia.com
- http://www.debian.org/security/2009/dsa-1938 www.debian.org
- http://www.openwall.com/lists/oss-security/2009/11/23/8 www.openwall.com
- http://www.openwall.com/lists/oss-security/2009/11/28/2 www.openwall.com
- http://www.securityfocus.com/bid/37395 www.securityfocus.com
- https://bugs.gentoo.org/show_bug.cgi?id=294256 bugs.gentoo.org