The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Feb 2, 2011 |
| Php | — | Upgrade to PHP version 5.2.15 | Oct 1, 2012 | Feb 2, 2011 |
| Suse | — | Upgrade php5-xslUpgrade php5-mbstringUpgrade php5-domUpgrade php5-xmlwriterUpgrade php5-wddxUpgrade php5-hashUpgrade php5-jsonUpgrade php5-iconvUpgrade php5-gmpUpgrade php5Upgrade php5-xmlrpcUpgrade php5-opensslUpgrade php5-bcmathUpgrade php5-exifUpgrade php5-mcryptUpgrade php5-sysvsemUpgrade php5-pdoUpgrade php5-mysqlUpgrade php5-ftpUpgrade php5-gettextUpgrade php5-xmlreaderUpgrade apache2-mod_php5Upgrade php5-ctypeUpgrade php5-fastcgiUpgrade php5-pcntlUpgrade php5-zipUpgrade php5-sysvmsgUpgrade php5-sysvshmUpgrade php5-curlUpgrade php5-tokenizerUpgrade php5-zlibUpgrade php5-shmopUpgrade php5-bz2Upgrade php5-ldapUpgrade php5-snmpUpgrade php5-dbaUpgrade php5-pearUpgrade php5-odbcUpgrade php5-calendarUpgrade php5-soapUpgrade php5-dbaseUpgrade php5-pgsqlUpgrade php5-pspellUpgrade php5-gdUpgrade php5-suhosin | Feb 17, 2015 | Jun 28, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub