CVE

Id
41452  
CVE No.
CVE-2009-4017  
Status
Candidate  
Description
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.  
Phase
Assigned (20091120)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
455243 41452 CVE-2009-4017 BUGTRAQ:20091120 PHP "multipart/form-data" denial of service  View
455244 41452 CVE-2009-4017 URL:http://www.securityfocus.com/archive/1/archive/1/507982/100/0/threaded  View
455245 41452 CVE-2009-4017 FULLDISC:20091120 PHP "multipart/form-data" denial of service  View
455246 41452 CVE-2009-4017 URL:http://seclists.org/fulldisclosure/2009/Nov/228  View
455247 41452 CVE-2009-4017 MLIST:[oss-security] 20091120 CVE request: php 5.3.1 update  View
455248 41452 CVE-2009-4017 URL:http://www.openwall.com/lists/oss-security/2009/11/20/2  View
455249 41452 CVE-2009-4017 MLIST:[oss-security] 20091120 Re: CVE request: php 5.3.1 update  View
455250 41452 CVE-2009-4017 URL:http://www.openwall.com/lists/oss-security/2009/11/20/7  View
455251 41452 CVE-2009-4017 MLIST:[php-announce] 20091119 5.3.1 Release announcement  View
455252 41452 CVE-2009-4017 URL:http://news.php.net/php.announce/79  View
455253 41452 CVE-2009-4017 MISC:http://www.acunetix.com/blog/websecuritynews/php-multipartform-data-denial-of-service/  View
455254 41452 CVE-2009-4017 CONFIRM:http://www.php.net/ChangeLog-5.php  View
455255 41452 CVE-2009-4017 CONFIRM:http://www.php.net/releases/5_3_1.php  View
455256 41452 CVE-2009-4017 CONFIRM:http://www.php.net/releases/5_2_12.php  View
455257 41452 CVE-2009-4017 CONFIRM:http://support.apple.com/kb/HT4077  View
455258 41452 CVE-2009-4017 APPLE:APPLE-SA-2010-03-29-1  View
455259 41452 CVE-2009-4017 URL:http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html  View
455260 41452 CVE-2009-4017 DEBIAN:DSA-1940  View
455261 41452 CVE-2009-4017 URL:http://www.debian.org/security/2009/dsa-1940  View
455262 41452 CVE-2009-4017 HP:HPSBUX02543  View
455263 41452 CVE-2009-4017 URL:http://marc.info/?l=bugtraq&m=127680701405735&w=2  View
455264 41452 CVE-2009-4017 HP:SSRT100152  View
455265 41452 CVE-2009-4017 URL:http://marc.info/?l=bugtraq&m=127680701405735&w=2  View
455266 41452 CVE-2009-4017 HP:HPSBMA02568  View
455267 41452 CVE-2009-4017 URL:http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995  View
455268 41452 CVE-2009-4017 HP:SSRT100219  View
455269 41452 CVE-2009-4017 URL:http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995  View
455270 41452 CVE-2009-4017 MANDRIVA:MDVSA-2009:303  View
455271 41452 CVE-2009-4017 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:303  View
455272 41452 CVE-2009-4017 MANDRIVA:MDVSA-2009:305  View
455273 41452 CVE-2009-4017 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2009:305  View
455274 41452 CVE-2009-4017 OVAL:oval:org.mitre.oval:def:10483  View
455275 41452 CVE-2009-4017 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10483  View
455276 41452 CVE-2009-4017 OVAL:oval:org.mitre.oval:def:6667  View
455277 41452 CVE-2009-4017 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6667  View
455278 41452 CVE-2009-4017 SECUNIA:37482  View
455279 41452 CVE-2009-4017 URL:http://secunia.com/advisories/37482  View
455280 41452 CVE-2009-4017 SECUNIA:37821  View
455281 41452 CVE-2009-4017 URL:http://secunia.com/advisories/37821  View
455282 41452 CVE-2009-4017 SECUNIA:40262  View
455283 41452 CVE-2009-4017 URL:http://secunia.com/advisories/40262  View
455284 41452 CVE-2009-4017 SECUNIA:41480  View
455285 41452 CVE-2009-4017 URL:http://secunia.com/advisories/41480  View
455286 41452 CVE-2009-4017 SECUNIA:41490  View
455287 41452 CVE-2009-4017 URL:http://secunia.com/advisories/41490  View
455288 41452 CVE-2009-4017 VUPEN:ADV-2009-3593  View
455289 41452 CVE-2009-4017 URL:http://www.vupen.com/english/advisories/2009/3593  View
455290 41452 CVE-2009-4017 XF:php-multipart-formdata-dos(54455)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41491 JVNDB-2009-002498 Linux kernel の fuse_direct_io 関数におけるサービス運用妨害 (DoS)の脆弱性 Linux kernel の fuse サブシステムの fs/fuse/file.c の fuse_direct_io 関数には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-4021 41452 4.9 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002498.html  View