CVE-2009-3294: Medium severity php vulnerability
The popen API function in TSRM/tsrmwin32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3294?
CVE-2009-3294 is categorized as a medium severity vulnerability that can lead to a denial of service.
How do I fix CVE-2009-3294?
To fix CVE-2009-3294, upgrade to PHP version 5.2.11 or 5.3.1 or later.
What software is affected by CVE-2009-3294?
CVE-2009-3294 affects PHP versions prior to 5.2.11 and 5.3.x versions prior to 5.3.1 on certain Windows operating systems.
What type of attack does CVE-2009-3294 enable?
CVE-2009-3294 allows attackers to cause a denial of service by exploiting the popen API function with crafted arguments.
On which platforms does CVE-2009-3294 occur?
CVE-2009-3294 specifically occurs on certain Windows operating systems running affected versions of PHP.