CVE-2007-1461

The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories.

Link	Resource
http://www.php-security.org/MOPB/MOPB-21-2007.html
http://www.securityfocus.com/bid/22954
http://us2.php.net/releases/4_4_7.php
http://us2.php.net/releases/5_2_2.php
http://docs.info.apple.com/article.html?artnum=306172
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://www.novell.com/linux/security/advisories/2007_32_php.html
http://www.securityfocus.com/bid/25159
http://secunia.com/advisories/25056	Vendor Advisory
http://secunia.com/advisories/26235	Vendor Advisory
http://www.vupen.com/english/advisories/2007/2732	Vendor Advisory

Configuration 1

cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0:beta1:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.11:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0:beta4:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.8:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.13:*:*:*:*:*:*:* cpe:2.3:a:php:php:*:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.7:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.17:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:2.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.15:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.16:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.10:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.4:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0:beta2:*:*:*:*:*:* cpe:2.3:a:php:php:2.0b10:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.18:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0:beta_4_patch1:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:1.0:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.12:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.0:beta3:*:*:*:*:*:* cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.14:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.9:*:*:*:*:*:*:* cpe:2.3:a:php:php:3.0.3:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:* cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*

---

Published : 2007-03-14 06:19

Updated : 2011-07-13 04:00

---

NVD link : CVE-2007-1461

Mitre link : CVE-2007-1461

No products.

CWE-264