FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-4483

This CVE name corresponds to:

Entered	Topic
2006-09-13	php -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-4483 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-4483
Phase	Assigned(20060831)

Description

The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.

References

Source	Reference
BUGTRAQ	20080527 rPSA-2008-0178-1 php php-mysql php-pgsql
MISC	http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7
MISC	http://cvs.php.net/viewvc.cgi/php-src/ext/curl/streams.c?r1=1.14.2.2.2.3&r2=1.14.2.2.2.4
CONFIRM	http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?view=log
CONFIRM	http://www.php.net/ChangeLog-5.php#5.1.5
CONFIRM	http://www.php.net/release_5_1_5.php
CONFIRM	http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0178
SUSE	SUSE-SA:2006:052
BID	19582
VUPEN	ADV-2006-3318
SECTRACK	1016984
SECUNIA	21546
SECUNIA	22039
SECUNIA	30411