NVD

Id
64929  
Name
CVE-2006-6383  
Description
PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.  
Reject
 
CVSS Version
2  
CVSS Score
4.6  
Severity
Medium  
CVSS Base Score
4.6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2016-12-20  
Published
2006-12-10  
Modified Date
2008-11-15  
Seq
2006-6383  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
339025 64929 CVE-2006-6383 http://cvs.php.net/viewcvs.cgi/php-src/ext/session/session.c?r1=1.336.2.53.2.7&r2=1.336.2.53.2.8  View
339026 64929 CVE-2006-6383 SUSE-SA:2007:020  View
339027 64929 CVE-2006-6383 20061208 PHP 5.2.0 session.save_path safe_mode and open_basedir bypass  View
339028 64929 CVE-2006-6383 2000  View
339029 64929 CVE-2006-6383 MDKSA-2007:038  View
339030 64929 CVE-2006-6383 OpenPKG-SA-2007.010  View
339031 64929 CVE-2006-6383 20061208 PHP 5.2.0 session.save_path safe_mode and open_basedir bypass  View
339032 64929 CVE-2006-6383 21508  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
60260 JVNDB-2006-002526 PHP における safe_mode 制限を回避される脆弱性 PHP には、safe_mode および open_basedir 制限を回避される脆弱性が存在します。 CVE-2006-6383 22485 CVE-2006-6383 64929 4.6 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002526.html 2006-12-10 2012-09-25 View