CVE-2009-3294

2009-09-2210:30:00

CWE-134

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

6.5

Confidence

High

EPSS

0.015

Percentile

87.1%

JSON

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) “e” or (2) “er” string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

Affected configurations

Nvd

Node

phpphpRange5.2.0–5.2.11

phpphpRange5.3.0–5.3.1

AND

microsoftwindows_7

microsoftwindows_server_2008

microsoftwindows_xp

VendorProductVersionCPE
phpphp*cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
microsoftwindows_7*cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*
microsoftwindows_server_2008*cpe:2.3:o:microsoft:windows_server_2008:*:*:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
php	php	*	cpe:2.3:a:php:php::::::::
microsoft	windows_7	*	cpe:2.3:o:microsoft:windows_7::::::::
microsoft	windows_server_2008	*	cpe:2.3:o:microsoft:windows_server_2008::::::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::::::::