CVE-2009-1272: Input Validation

Published Apr 8, 2009

Updated

The phpzipmakerelativepath function in phpzip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.

Affected Software

10 affected components

PHP PHP=5.2.4

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.3

PHP PHP=5.2.0

PHP PHP=5.2.4

PHP PHP=5.2.1

PHP PHP=5.2.8

Event History

Apr 8, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1272?

CVE-2009-1272 has a severity level that can lead to a denial of service, causing crashes during the extraction of ZIP files.

How do I fix CVE-2009-1272?

To mitigate CVE-2009-1272, it is recommended to upgrade to PHP version 5.2.9 or later.

What PHP versions are affected by CVE-2009-1272?

CVE-2009-1272 affects PHP versions 5.2.0 through 5.2.8.

What kind of attack does CVE-2009-1272 facilitate?

CVE-2009-1272 allows context-dependent attackers to exploit the vulnerability by providing crafted ZIP files with relative paths.

Is CVE-2009-1272 exploitable remotely?

Yes, CVE-2009-1272 is exploitable remotely if the vulnerable PHP application processes ZIP file uploads.