Description

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.

Remediation

References

CVE-2009-0754

Related Vulnerabilities

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-0207)

WordPress Plugin FireStats 'firestats-wordpress.php' Remote File Include (1.6.1)

Atlassian Jira Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-11581)

WordPress Plugin Custom Field Suite Cross-Site Request Forgery (2.5.15)

Joomla! Core Multiple Vulnerabilities (1.5.0 - 3.8.11)

Severity

Low

Classification

CVE-2009-0754 CWE-134

Tags

Missing Update Known Vulnerabilities