CVE-2009-0754
published 2009-03-03CVE-2009-0754: PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying…
PriorityP412low2.1CVSS 2.0
AVLACLAuNCNIPAN
EXPLOIT
EPSS
0.95%
56.7th percentile
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| php | php | — | — |
| php | php | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
vendor_ubuntu2.6LOW
vendor_redhat2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mv3x-q5p2-7h93: PHP 4
ghsa_unreviewed·2022-05-02
CVE-2009-0754 [LOW] CWE-134 GHSA-mv3x-q5p2-7h93: PHP 4
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2009-04-20·CVSS 2.6
CVE-2008-5814 [LOW] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP vulnerabilities
It was discovered that PHP did not sanitize certain error messages when
display_errors is enabled, which could result in browsers becoming
vulnerable to cross-site scripting attacks when processing the output. With
cross-site scripting vulnerabilities, if a user were tricked into viewing
server output during a crafted server request, a remote attacker could
exploit this to modify the contents, or steal confidential data (such as
passwords), within the same domain. (CVE-2008-5814)
It was discovered that PHP did not properly handle the
mbstring.func_overload setting within .htaccess files when using virtual
hosts. A virtual host administrator could use this flaw to cause settings
to be applied to other virtual hosts on the same serve
Red Hat
PHP mbstring.func_overload web server denial of service
vendor_redhat·2004-02-27·CVSS 2.1
CVE-2009-0754 [LOW] PHP mbstring.func_overload web server denial of service
PHP mbstring.func_overload web server denial of service
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
No detection rules found.
http://bugs.php.net/bug.php?id=27421http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://secunia.com/advisories/34642http://secunia.com/advisories/34830http://secunia.com/advisories/35003http://secunia.com/advisories/35007http://secunia.com/advisories/35306http://www.debian.org/security/2009/dsa-1789http://www.openwall.com/lists/oss-security/2009/01/30/1http://www.openwall.com/lists/oss-security/2009/02/03/3http://www.openwall.com/lists/oss-security/2009/02/25/3http://www.redhat.com/support/errata/RHSA-2009-0350.htmlhttp://www.securitytracker.com/id?1021979https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035https://usn.ubuntu.com/761-1/https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.htmlhttp://bugs.php.net/bug.php?id=27421http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://secunia.com/advisories/34642http://secunia.com/advisories/34830http://secunia.com/advisories/35003http://secunia.com/advisories/35007http://secunia.com/advisories/35306http://www.debian.org/security/2009/dsa-1789http://www.openwall.com/lists/oss-security/2009/01/30/1http://www.openwall.com/lists/oss-security/2009/02/03/3http://www.openwall.com/lists/oss-security/2009/02/25/3http://www.redhat.com/support/errata/RHSA-2009-0350.htmlhttp://www.securitytracker.com/id?1021979https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035https://usn.ubuntu.com/761-1/https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html
2009-03-03
Published