CVE-2006-4481

PHP - Safe Mode and Open Basedir Bypass via file_exists and imap_reopen Functions

Title source: llm

Description

The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings. NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017.

References (10)

Core 10

Core References

Patch x_refsource_confirm

http://www.php.net/release_5_1_5.php

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21768

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/usn-342-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/22039

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDKSA-2006:162

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/19582

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21546

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3318

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21842

Vendor Advisory vendor-advisory x_refsource_suse

http://www.novell.com/linux/security/advisories/2006_52_php.html

Scores

EPSS 0.0021

EPSS Percentile 43.7%

Details

Status published

Products (4)

php/php 5.1.0

php/php 5.1.1

php/php 5.1.2

php/php 5.1.4

Published Aug 31, 2006

Tracked Since Feb 18, 2026