Description

The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.

Remediation

References

CVE-2011-1657

Related Vulnerabilities

WordPress Plugin RSS Post Importer Unspecified Vulnerability (2.5.0)

Apache HTTP Server Other Vulnerability (CVE-2002-2029)

Drupal Core 8.x Multiple Vulnerabilities (8.0.0 - 8.1.9)

Drupal Core 8.5.x Remote Code Execution (8.5.0 - 8.5.2)

Ruby Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2018-8780)

Severity

Medium

Classification

CVE-2011-1657

Tags

Missing Update Known Vulnerabilities