Description

This alert was generated using only banner information. It may be a false positive.

The PHP development team would like to announce the immediate availability of PHP 5.2.6. This release focuses on improving the stability of the PHP 5.2.x branch with over 120 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.6:

  • Fixed possible stack buffer overflow in the FastCGI SAPI identified by Andrei Nigmatulin.
  • Fixed integer overflow in printf() identified by Maksymilian Aciemowicz.
  • Fixed security issue detailed in CVE-2008-0599 identified by Ryan Permeh.
  • Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz.
  • Properly address incomplete multibyte chars inside escapeshellcmd() identified by Stefan Esser.
  • Upgraded bundled PCRE to version 7.6


Affected PHP versions (up to 5.2.5).

Remediation

Upgrade PHP to the latest version.

References

PHP 5.2.6 Release Announcement

PHP Homepage

Related Vulnerabilities

WordPress Plugin Simple Slideshow Manager Multiple Cross-Site Scripting Vulnerabilities (2.3)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-5242)

Vanilla Forums Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-9889)

Magento Session Fixation Vulnerability (CVE-2019-7849)

MySQL CVE-2012-0489 Vulnerability (CVE-2012-0489)

Severity

High

Classification

CVE-2007-4850 CVE-2008-0599 CVE-2008-0674 CVE-2008-1384 CVE-2008-2050 CVE-2008-2051 CWE-1104 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update Denial Of Service Code Execution