CVE-2012-0057

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://bugs.php.net/bug.php?id=54446	Patch Vendor Advisory
http://openwall.com/lists/oss-security/2012/01/14/2
http://openwall.com/lists/oss-security/2012/01/14/3
http://openwall.com/lists/oss-security/2012/01/15/1
http://openwall.com/lists/oss-security/2012/01/13/4
http://openwall.com/lists/oss-security/2012/01/18/3
http://openwall.com/lists/oss-security/2012/01/13/5
http://openwall.com/lists/oss-security/2012/01/13/10
http://openwall.com/lists/oss-security/2012/01/14/1
http://openwall.com/lists/oss-security/2012/01/15/2
http://openwall.com/lists/oss-security/2012/01/15/10
http://php.net/ChangeLog-5.php#5.3.9
http://openwall.com/lists/oss-security/2012/01/13/6
http://openwall.com/lists/oss-security/2012/01/13/7
http://www.debian.org/security/2012/dsa-2399
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
http://secunia.com/advisories/48668
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
https://exchange.xforce.ibmcloud.com/vulnerabilities/72908
http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:php:php:5.3.4:::::::*
	cpe:2.3:a:php:php:5.3.6:::::::*
	cpe:2.3:a:php:php:5.3.0:::::::*
	cpe:2.3:a:php:php:5.3.1:::::::*
	cpe:2.3:a:php:php:5.2.10:::::::*
	cpe:2.3:a:php:php:5.2.13:::::::*
	cpe:2.3:a:php:php:5.2.4:::::::*
	cpe:2.3:a:php:php:5.2.3:::::::*
	cpe:2.3:a:php:php:5.1.1:::::::*
	cpe:2.3:a:php:php:5.1.0:::::::*
	cpe:2.3:a:php:php:5.0.0:beta4::::::
	cpe:2.3:a:php:php::::::::
	cpe:2.3:a:php:php:5.2.9:::::::*
	cpe:2.3:a:php:php:5.1.5:::::::*
	cpe:2.3:a:php:php:5.2.14:::::::*
	cpe:2.3:a:php:php:5.0.0:beta1::::::
	cpe:2.3:a:php:php:5.1.6:::::::*
	cpe:2.3:a:php:php:5.2.7:::::::*
	cpe:2.3:a:php:php:5.2.2:::::::*
	cpe:2.3:a:php:php:5.0.5:::::::*
	cpe:2.3:a:php:php:5.0.1:::::::*
	cpe:2.3:a:php:php:5.1.4:::::::*
	cpe:2.3:a:php:php:5.2.5:::::::*
	cpe:2.3:a:php:php:5.0.4:::::::*
	cpe:2.3:a:php:php:5.2.11:::::::*
	cpe:2.3:a:php:php:5.2.17:::::::*
	cpe:2.3:a:php:php:5.3.7:::::::*
	cpe:2.3:a:php:php:5.0.0:rc3::::::
	cpe:2.3:a:php:php:5.2.0:::::::*
	cpe:2.3:a:php:php:5.0.0:beta3::::::
	cpe:2.3:a:php:php:5.3.2:::::::*
	cpe:2.3:a:php:php:5.2.15:::::::*
	cpe:2.3:a:php:php:5.2.1:::::::*
	cpe:2.3:a:php:php:5.1.2:::::::*
	cpe:2.3:a:php:php:5.2.16:::::::*
	cpe:2.3:a:php:php:5.2.12:::::::*
	cpe:2.3:a:php:php:5.2.6:::::::*
	cpe:2.3:a:php:php:5.0.0:rc2::::::
	cpe:2.3:a:php:php:5.3.3:::::::*
	cpe:2.3:a:php:php:5.0.3:::::::*
	cpe:2.3:a:php:php:5.1.3:::::::*
	cpe:2.3:a:php:php:5.0.0:rc1::::::
	cpe:2.3:a:php:php:5.0.2:::::::*
	cpe:2.3:a:php:php:5.3.5:::::::*
	cpe:2.3:a:php:php:5.0.0:::::::*
	cpe:2.3:a:php:php:5.0.0:beta2::::::
	cpe:2.3:a:php:php:5.2.8:::::::*

Information

Published : 2012-02-01 16:55

Updated : 2018-01-17 18:29

NVD link : CVE-2012-0057

Mitre link : CVE-2012-0057

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

php

6.4 /10