vulnwire
5.0med

CVE-2009-3294

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems,…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.7%
percentile 86%
Public exploits
0
none known

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

Exploit prediction (EPSS)

2.73% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-134 Use of Externally-Controlled Format String
Technology feeds
PHP (RSS, critical only)

References

  • php.net /ChangeLog-5.php#5.2.11 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2009/11/20/3 · mailing-list, x_refsource_MLIST, x_transferred
  • news.php.net /php.announce/79 · mailing-list, x_refsource_MLIST, x_transferred
  • php.net /releases/5_2_11.php · x_refsource_CONFIRM, x_transferred
  • php.net /ChangeLog-5.php · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2009/11/20/2 · mailing-list, x_refsource_MLIST, x_transferred
  • bugs.php.net /bug.php?id=44683 · x_refsource_CONFIRM, x_transferred
  • php.net /releases/5_3_1.php · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2009/09/20/1 · mailing-list, x_refsource_MLIST, x_transferred
  • osvdb.org /58188 · vdb-entry, x_refsource_OSVDB, x_transferred
  • svn.php.net /viewvc?view=revision&revision=287779 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.