CVE-2006-4481: High severity PHP PHP vulnerability
Published Aug 31, 2006
·Updated
The (1) fileexists and (2) imapreopen functions in PHP before 5.1.5 do not check for the safemode and openbasedir settings, which allows local users to bypass the settings. NOTE: the errorlog function is covered by CVE-2006-3011, and the imapopen function is covered by CVE-2006-1017.
Affected Software
4 affected components
PHP PHP=5.1.2
PHP PHP=5.1.1
PHP PHP=5.1.4
PHP PHP=5.1.0
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Aug 31, 2006
CVE Published
09:04 PM
Sep 1, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-4481?
CVE-2006-4481 is classified as a medium severity vulnerability.
2
How do I fix CVE-2006-4481?
To fix CVE-2006-4481, upgrade PHP to version 5.1.5 or later.
3
Which versions of PHP are affected by CVE-2006-4481?
CVE-2006-4481 affects PHP versions 5.1.0, 5.1.1, 5.1.2, and 5.1.4.
4
What functions are vulnerable in CVE-2006-4481?
The functions file_exists and imap_reopen are vulnerable in CVE-2006-4481.
5
Can local users exploit CVE-2006-4481?
Yes, local users can exploit CVE-2006-4481 to bypass the safe_mode and open_basedir restrictions.