THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2012-1823

Reserved:2012-03-21
Published:2012-05-11
Updated:2024-06-13

Description

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

References

http://marc.info/?l=bugtraq&m=134012830914727&w=2 (SSRT100856) vendor-advisory

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html (SUSE-SU-2012:0604) vendor-advisory

http://www.securitytracker.com/id?1027022 (1027022) vdb-entry

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 (HPSBMU02786) vendor-advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:068 (MDVSA-2012:068) vendor-advisory

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html (openSUSE-SU-2012:0590) vendor-advisory

http://rhn.redhat.com/errata/RHSA-2012-0546.html (RHSA-2012:0546) vendor-advisory

http://rhn.redhat.com/errata/RHSA-2012-0568.html (RHSA-2012:0568) vendor-advisory

http://rhn.redhat.com/errata/RHSA-2012-0569.html (RHSA-2012:0569) vendor-advisory

http://www.php.net/ChangeLog-5.php#5.4.2

http://secunia.com/advisories/49014 (49014) third-party-advisory

http://rhn.redhat.com/errata/RHSA-2012-0570.html (RHSA-2012:0570) vendor-advisory

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html (SUSE-SU-2012:0598) vendor-advisory

https://bugs.php.net/bug.php?id=61910

http://www.kb.cert.org/vuls/id/673343 (VU#673343) third-party-advisory

http://rhn.redhat.com/errata/RHSA-2012-0547.html (RHSA-2012:0547) vendor-advisory

http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html (APPLE-SA-2012-09-19-2) vendor-advisory

http://support.apple.com/kb/HT5501

http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/

http://secunia.com/advisories/49065 (49065) third-party-advisory

http://www.kb.cert.org/vuls/id/520827 (VU#520827) third-party-advisory

https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 (SSRT100877) vendor-advisory

http://marc.info/?l=bugtraq&m=134012830914727&w=2 (HPSBUX02791) vendor-advisory

http://www.debian.org/security/2012/dsa-2465 (DSA-2465) vendor-advisory

http://secunia.com/advisories/49085 (49085) third-party-advisory

http://www.php.net/archive/2012.php#id2012-05-03-1

http://secunia.com/advisories/49087 (49087) third-party-advisory

http://www.openwall.com/lists/oss-security/2024/06/07/1 ([oss-security] 20240606 PHP security releases 8.3.8, 8.2.20, and 8.1.29) mailing-list

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ (FEDORA-2024-49aba7b305) vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ (FEDORA-2024-52c23ef1ec) vendor-advisory

cve.org CVE-2012-1823

nvd.nist.gov CVE-2012-1823

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2012-1823