CVE-2009-4017

Publication date 23 November 2009

Last updated 24 July 2024

Ubuntu priority

PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	9.10 karmic	Fixed 5.2.10.dfsg.1-2ubuntu6.3
	9.04 jaunty	Fixed 5.2.6.dfsg.1-3ubuntu4.4
	8.10 intrepid	Fixed 5.2.6-2ubuntu4.5
	8.04 LTS hardy	Fixed 5.2.4-2ubuntu5.9
	6.06 LTS dapper	Fixed 5.1.2-1ubuntu3.17

Notes

mdeslaur

introduces a new option

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://svn.php.net/viewvc?view=revision&revision=289990 Upstream: http://svn.php.net/viewvc?view=revision&revision=290029 Upstream: http://svn.php.net/viewvc?view=revision&revision=290306

CVE-2009-4017

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references