CVE-2007-0905
PHP < 5.2.1 - Safe Mode and Open Basedir Bypass via Session Extension
Title source: llmDescription
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension. NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
References (9)
Core 9
Core References
Vendor Advisory vendor-advisory
x_refsource_trustix
http://www.trustix.org/errata/2007/0009/
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/22496
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/32768
Release Notes x_refsource_confirm
http://www.php.net/releases/5_2_1.php
Vendor Advisory vendor-advisory
x_refsource_openpkg
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24089
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/24419
Vendor Advisory x_refsource_confirm
http://www.php.net/ChangeLog-5.php#5.2.1
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2007/0546
Scores
EPSS
0.0163
EPSS Percentile
82.1%
Details
Status
published
Products (44)
php/php
3.0
php/php
3.0.1
php/php
3.0.2
php/php
3.0.3
php/php
3.0.4
php/php
3.0.5
php/php
3.0.6
php/php
3.0.7
php/php
3.0.8
php/php
3.0.9
... and 34 more
Published
Feb 13, 2007
Tracked Since
Feb 18, 2026