CVE-2006-2660: Low severity php php vulnerability

Published Jun 13, 2006

Updated

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.

Affected Software

30 affected components

PHP PHP=4.3.9

PHP PHP=4.2.0

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=4.3.6

PHP PHP=5.1.4

PHP PHP=4.3.7

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=4.2.3

PHP PHP=4.1.2

PHP PHP=4.3.1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=4.4.1

PHP PHP=4.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

Event History

Jun 13, 2006

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-2660?

CVE-2006-2660 is categorized as a low-severity vulnerability due to its requirement for local access.

How do I fix CVE-2006-2660?

To mitigate CVE-2006-2660, update PHP to version 4.4.3 or later, or 5.2.0 and above.

What types of PHP versions are affected by CVE-2006-2660?

CVE-2006-2660 affects PHP versions 5.1.4 and 4.x before 4.4.3.

Who is impacted by the CVE-2006-2660 vulnerability?

Local users and attackers with access to the vulnerable PHP installation are impacted by CVE-2006-2660.

What is the nature of the vulnerability described in CVE-2006-2660?

CVE-2006-2660 is a buffer consumption vulnerability that allows local users to bypass restrictions when creating PHP files.