diff options
| author | Martin Wilke <miwi@FreeBSD.org> | 2009-05-16 20:36:16 +0000 |
|---|---|---|
| committer | Martin Wilke <miwi@FreeBSD.org> | 2009-05-16 20:36:16 +0000 |
| commit | 097bafc1e79587097c2c372e803bc77b91661fb0 (patch) | |
| tree | a8ad12097ab47a0544f12c7495358b2c5d58a528 /security | |
| parent | - Document libwmf -- embedded GD library Use-After-Free vulnerability (diff) | |
- Document php -- ini database truncation inside dba_replace() function
PR: 129459 (based on)
Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru>
Notes
Notes:
svn path=/head/; revision=234012
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index ee5f01f42a5c..2484a21f6edc 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,40 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="1e8031be-4258-11de-b67a-0030843d3802"> + <topic>php -- ini database truncation inside dba_replace() function</topic> + <affects> + <package> + <name>php4-dba</name> + <range><lt>4.4.9_1</lt></range> + </package> + <package> + <name>php5-dba</name> + <range><lt>5.2.7</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>securityfocus research reports:</p> + <blockquote cite="http://www.securityfocus.com/archive/1/498746/30/0/threaded"> + <p>A bug that leads to the emptying of the INI file contents if + the database key was not found exists in PHP dba extension in + versions 5.2.6, 4.4.9 and earlier.</p> + <p>Function dba_replace() are not filtering strings key and value. + There is a possibility for the destruction of the file.</p> + </blockquote> + </body> + </description> + <references> + <url>http://www.securityfocus.com/archive/1/498746/30/0/threaded</url> + <url>http://securityreason.com/achievement_securityalert/58</url> + </references> + <dates> + <discovery>2009-11-28</discovery> + <entry>2009-05-16</entry> + </dates> + </vuln> + <vuln vid="6a245f31-4254-11de-b67a-0030843d3802"> <topic>libwmf -- embedded GD library Use-After-Free vulnerability</topic> <affects> |