CVE-2002-0986: Medium severity PHP PHP vulnerability
Published Sep 24, 2002
·Updated
The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote attackers to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."
Affected Software
18 affected components
PHP PHP=4.2.0
PHP PHP=4.1.0
PHP PHP=4.0.4
PHP PHP=4.0.5
PHP PHP=4.2.2
PHP PHP=4.0.3-patch1
PHP PHP=4.0.7
PHP PHP=4.0.2
PHP PHP=4.1.1
PHP PHP=4.0.1-patch1
PHP PHP=4.0
PHP PHP=4.0.1-patch2
PHP PHP=4.0.6
PHP PHP=4.1.2
PHP PHP=3.0.18
PHP PHP=4.2.1
PHP PHP=4.0.1
PHP PHP=4.0.3
Remediation
Patch Available
Event History
Sep 24, 2002
CVE Published
04:00 AM
Sep 1, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-0986?
CVE-2002-0986 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2002-0986?
To mitigate CVE-2002-0986, upgrade your PHP version to 4.2.3 or later, which addresses the issue.
3
What are the affected PHP versions for CVE-2002-0986?
CVE-2002-0986 affects PHP versions from 4.0.1 to 4.2.2.
4
Can CVE-2002-0986 be exploited remotely?
Yes, CVE-2002-0986 can be exploited by remote attackers to manipulate email content.
5
What type of attacks can CVE-2002-0986 facilitate?
CVE-2002-0986 can allow attackers to use PHP as a spam proxy by injecting control characters in email headers.