CVE-2014-3981

PHP < 5.3.29 - Arbitrary File Overwrite via Symlink Attack on /tmp/phpglibccheck

Title source: llm
STIX 2.1

Description

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

References (12)

Core 12
Core References
Third Party Advisory x_refsource_confirm
https://support.apple.com/HT204659
Third Party Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21683486
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=141017844705317&w=2
Mailing List, Third Party Advisory vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=141390017113542&w=2
Patch, Vendor Advisory x_refsource_confirm
https://bugs.php.net/bug.php?id=67390
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1104978
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Third Party Advisory x_refsource_confirm
http://support.apple.com/kb/HT6443
Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Jun/21
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2014/06/06/12

Scores

EPSS 0.0022
EPSS Percentile 44.4%

Details

CWE
CWE-59
Status published
Products (1)
php/php < 5.3.29
Published Jun 08, 2014
Tracked Since Feb 18, 2026