CVE-2009-2626
Published: 1 December 2009
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
php5 Launchpad, Ubuntu, Debian |
dapper |
Released
(5.1.2-1ubuntu3.18)
|
| hardy |
Released
(5.2.4-2ubuntu5.10)
|
|
| intrepid |
Released
(5.2.6-2ubuntu4.6)
|
|
| jaunty |
Released
(5.2.6.dfsg.1-3ubuntu4.5)
|
|
| karmic |
Released
(5.2.10.dfsg.1-2ubuntu6.4)
|
|
| upstream |
Needs triage
|
|
|
Patches: upstream: http://svn.php.net/viewvc?view=revision&revision=284156 upstream: http://svn.php.net/viewvc?view=revision&revision=284157 upstream: http://svn.php.net/viewvc?view=revision&revision=283944 upstream: http://svn.php.net/viewvc?view=revision&revision=283946 |
||