Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
PHP Use of Externally-Controlled Format String Vulnerability - CVE-2010-2094 - Vulnerability Database
PHP

PHP Use of Externally-Controlled Format String Vulnerability - CVE-2010-2094

Medium
Reference: CVE-2010-2094
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2010-2094
Title: PHP Use of Externally-Controlled Format String Vulnerability
Overview:

Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush (2) phar_wrapper_unlink (3) phar_parse_url or (4) phar_wrapper_open_url functions in ext/phar/stream.c and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c which triggers errors in the php_stream_wrapper_log_error function.