CVE-2009-4023: Code Injection
Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote attackers to read and write arbitrary files via a crafted $from parameter, a different vector than CVE-2009-4111.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4023?
CVE-2009-4023 is classified as a high-severity vulnerability due to its potential to allow remote attackers to read and write arbitrary files.
How do I fix CVE-2009-4023?
To fix CVE-2009-4023, it is recommended to upgrade the Mail package to version 1.1.15 or later, which addresses this vulnerability.
What type of attacks can be executed using CVE-2009-4023?
CVE-2009-4023 allows attackers to exploit the argument injection vulnerability to perform unauthorized file read and write operations.
Which software is affected by CVE-2009-4023?
CVE-2009-4023 affects the Mail package version 1.1.14 for PEAR.
What is the root cause of CVE-2009-4023?
The root cause of CVE-2009-4023 lies in the insecure handling of the $from parameter in the sendmail implementation of the Mail::Send method.