CVE-2011-0752: Input Validation

Q: What is the severity of CVE-2011-0752?

CVE-2011-0752 is considered a moderate severity vulnerability due to the potential for unauthorized access to sensitive data.

Q: How do I fix CVE-2011-0752?

To fix CVE-2011-0752, upgrade PHP to version 5.2.15 or later.

Q: What software versions are affected by CVE-2011-0752?

CVE-2011-0752 affects PHP versions prior to 5.2.15, including multiple older versions.

Q: What kind of attacks can exploit CVE-2011-0752?

Attackers can use CVE-2011-0752 to bypass access restrictions and manipulate data structures.

Q: Is CVE-2011-0752 still relevant today?

While CVE-2011-0752 impacts older PHP versions, it highlights risks in unpatched software, making it relevant for legacy systems.

Published Feb 2, 2011

Updated

The extract function in PHP before 5.2.15 does not prevent use of the EXTROVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.

Affected Software

99 affected components

PHP PHP<=5.2.14

PHP PHP=1.0

PHP PHP=2.0

PHP PHP=2.0b10

PHP PHP=3.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=3.0.3

PHP PHP=3.0.4

PHP PHP=3.0.5

PHP PHP=3.0.6

PHP PHP=3.0.7

PHP PHP=3.0.8

PHP PHP=3.0.9

PHP PHP=3.0.10

PHP PHP=3.0.11

PHP PHP=3.0.12

PHP PHP=3.0.13

PHP PHP=3.0.14

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=3.0.17

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.0-beta1

PHP PHP=4.0-beta2

PHP PHP=4.0-beta3

PHP PHP=4.0-beta4

PHP PHP=4.0.0

PHP PHP=4.0.1

PHP PHP=4.0.2

PHP PHP=4.0.3

PHP PHP=4.0.4

PHP PHP=4.0.5

PHP PHP=4.0.6

PHP PHP=4.0.7

PHP PHP=4.1.0

PHP PHP=4.1.1

PHP PHP=4.1.2

PHP PHP=4.2.0

PHP PHP=4.2.1

PHP PHP=4.2.2

PHP PHP=4.2.3

PHP PHP=4.3.0

PHP PHP=4.3.1

PHP PHP=4.3.2

PHP PHP=4.3.3

PHP PHP=4.3.4

PHP PHP=4.3.5

PHP PHP=4.3.6

PHP PHP=4.3.7

PHP PHP=4.3.8

PHP PHP=4.3.9

PHP PHP=4.3.10

PHP PHP=4.3.11

PHP PHP=4.4.0

PHP PHP=4.4.1

PHP PHP=4.4.2

PHP PHP=4.4.3

PHP PHP=4.4.4

PHP PHP=4.4.5

PHP PHP=4.4.6

PHP PHP=4.4.7

PHP PHP=4.4.8

PHP PHP=4.4.9

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.0

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

PHP PHP=5.2.1

PHP PHP=5.2.2

PHP PHP=5.2.3

PHP PHP=5.2.4

PHP PHP=5.2.5

PHP PHP=5.2.6

PHP PHP=5.2.7

PHP PHP=5.2.8

PHP PHP=5.2.9

PHP PHP=5.2.10

PHP PHP=5.2.11

PHP PHP=5.2.12

PHP PHP=5.2.13

Event History

Feb 2, 2011

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-0752?

CVE-2011-0752 is considered a moderate severity vulnerability due to the potential for unauthorized access to sensitive data.

How do I fix CVE-2011-0752?

To fix CVE-2011-0752, upgrade PHP to version 5.2.15 or later.

What software versions are affected by CVE-2011-0752?