NVD

Id
50498  
Name
CVE-2009-3294  
Description
The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-07  
Published
2009-09-22  
Modified Date
2009-11-25  
Seq
2009-3294  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
255447 50498 CVE-2009-3294 http://bugs.php.net/bug.php?id=44683  View
255448 50498 CVE-2009-3294 [php-announce] 20091119 5.3.1 Release announcement  View
255449 50498 CVE-2009-3294 http://svn.php.net/viewvc?view=revision&revision=287779  View
255450 50498 CVE-2009-3294 [oss-security] 20090920 Re: CVE Request -- PHP 5 - 5.2.11  View
255451 50498 CVE-2009-3294 [oss-security] 20091120 CVE request: php 5.3.1 update  View
255452 50498 CVE-2009-3294 [oss-security] 20091120 Re: CVE request: php 5.3.1 update  View
255453 50498 CVE-2009-3294 http://www.php.net/ChangeLog-5.php  View
255454 50498 CVE-2009-3294 http://www.php.net/ChangeLog-5.php#5.2.11  View
255455 50498 CVE-2009-3294 http://www.php.net/releases/5_2_11.php  View
255456 50498 CVE-2009-3294 http://www.php.net/releases/5_3_1.php  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41173 JVNDB-2009-002180 PHP の popen API 関数におけるサービス運用妨害 (DoS) の脆弱性 特定の Windows OS で稼働している PHP の popen API 関数には、第 2 引数内の "e" または "er" 文字の処理に不備があるため、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2009-3294 40725 CVE-2009-3294 50498 5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002180.html 2009-09-16 2009-11-05 View