CVE-2008-5658: Path Traversal
Published Dec 17, 2008
·Updated
Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.
Affected Software
27 affected components
PHP PHP=5.1.5
PHP PHP=5.1.2
PHP PHP=5.1.1
PHP PHP=5.0.0-beta1
PHP PHP=5.1.6
PHP PHP=5.2.2
PHP PHP=5.0.5
PHP PHP=5.0.1
PHP PHP=5.1.4
PHP PHP=5.2.5
PHP PHP=5.0.4
PHP PHP=5.0.0-rc2
PHP PHP=5.2.3
PHP PHP=5.0.3
PHP PHP=5.1.0
PHP PHP=5.0.0-rc3
PHP PHP=5.2.0
PHP PHP=5.2.4
PHP PHP=5.0.0-beta3
PHP PHP=5.1.3
PHP PHP=5.0.0-rc1
PHP PHP=5.0.2
PHP PHP<=5.2.6
PHP PHP=5.2.1
PHP PHP=5.0.0-beta4
PHP PHP=5.0.0
PHP PHP=5.0.0-beta2
Event History
Dec 17, 2008
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-5658?
CVE-2008-5658 is classified as a critical vulnerability due to its potential to allow attackers to write arbitrary files.
2
How do I fix CVE-2008-5658?
To fix CVE-2008-5658, upgrade PHP to version 5.2.7 or later.
3
What are the affected software versions for CVE-2008-5658?
CVE-2008-5658 affects PHP versions up to and including 5.2.6.
4
What type of vulnerability is CVE-2008-5658?
CVE-2008-5658 is a directory traversal vulnerability in the ZipArchive::extractTo function.
5
Who can exploit CVE-2008-5658?
Context-dependent attackers can exploit CVE-2008-5658 by crafting ZIP files that include 'dot dot' sequences.