CVE

Id
24817  
CVE No.
CVE-2007-1460  
Status
Candidate  
Description
The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories.  
Phase
Assigned (20070314)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
245748 24817 CVE-2007-1460 MISC:http://www.php-security.org/MOPB/MOPB-20-2007.html  View
245749 24817 CVE-2007-1460 CONFIRM:http://us2.php.net/releases/4_4_7.php  View
245750 24817 CVE-2007-1460 CONFIRM:http://us2.php.net/releases/5_2_2.php  View
245751 24817 CVE-2007-1460 CONFIRM:http://docs.info.apple.com/article.html?artnum=306172  View
245752 24817 CVE-2007-1460 APPLE:APPLE-SA-2007-07-31  View
245753 24817 CVE-2007-1460 URL:http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html  View
245754 24817 CVE-2007-1460 SUSE:SUSE-SA:2007:032  View
245755 24817 CVE-2007-1460 URL:http://www.novell.com/linux/security/advisories/2007_32_php.html  View
245756 24817 CVE-2007-1460 BID:22954  View
245757 24817 CVE-2007-1460 URL:http://www.securityfocus.com/bid/22954  View
245758 24817 CVE-2007-1460 BID:25159  View
245759 24817 CVE-2007-1460 URL:http://www.securityfocus.com/bid/25159  View
245760 24817 CVE-2007-1460 VUPEN:ADV-2007-2732  View
245761 24817 CVE-2007-1460 URL:http://www.vupen.com/english/advisories/2007/2732  View
245762 24817 CVE-2007-1460 SECUNIA:25056  View
245763 24817 CVE-2007-1460 URL:http://secunia.com/advisories/25056  View
245764 24817 CVE-2007-1460 SECUNIA:26235  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
53009 JVNDB-2007-001701 conga の luci server コンポーネントにおけるパスワードを不正に取得される脆弱性 conga の luci server コンポーネントは、password entry フィールドの Value 属性にパスワードを格納することで Add System/Cluster タスクフローのページロード間にパスワードを保存するため、パスワードを不正に取得される脆弱性が存在します。 CVE-2007-1462 24817 4.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001701.html  View