CVE-2010-1130

Publication date 26 March 2010

Last updated 24 July 2024

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	10.04 LTS lucid	Not affected
	9.10 karmic	Fixed 5.2.10.dfsg.1-2ubuntu6.5
	9.04 jaunty	Fixed 5.2.6.dfsg.1-3ubuntu4.6
	8.10 intrepid	Ignored end of life, was needed
	8.04 LTS hardy	Fixed 5.2.4-2ubuntu5.12
	6.06 LTS dapper	Not affected

Notes

mdeslaur

actually fixed in 5.3.2 open_basedir and safe_mode issue dapper doesn't try and strip ; chars, so not vulnerable

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://svn.php.net/viewvc?view=revision&revision=294272

CVE-2010-1130

Status

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references