CVE-2009-0754

Published: Mar 3, 2009Modified: Apr 23, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.

Affected (2)

Products: Php: Php

1 product

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Php Php	Version 4.4.4
Php Php	Version 5.1.6

Running on/with	Platform Versions
Apache Apache	All versions

Related CWEs

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (34)

http://bugs.php.net/bug.php?id=27421

Source: cve@mitre.org

ExploitVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: cve@mitre.org

http://secunia.com/advisories/34642

Source: cve@mitre.org

http://secunia.com/advisories/34830

Source: cve@mitre.org

http://secunia.com/advisories/35003

Source: cve@mitre.org

http://secunia.com/advisories/35007

Source: cve@mitre.org

http://secunia.com/advisories/35306

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1789

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/01/30/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/02/03/3

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2009/02/25/3

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2009-0350.html

Source: cve@mitre.org

http://www.securitytracker.com/id?1021979

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035

Source: cve@mitre.org

https://usn.ubuntu.com/761-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html

Source: cve@mitre.org

http://bugs.php.net/bug.php?id=27421

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitVendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34642

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34830

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35003

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35007

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35306

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1789

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/01/30/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/02/03/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2009/02/25/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0350.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021979

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/761-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.