what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2012-1045-01

Posted Jun 28, 2012

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2012-1045-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations content. Note: This update disables file writing by default. A new PHP configuration directive, "xsl.security_prefs", can be used to enable file writing in XSLT.

tags | advisory, remote, web, arbitrary, php

systems | linux, redhat

advisories | CVE-2011-4153, CVE-2012-0057, CVE-2012-0789, CVE-2012-1172, CVE-2012-2336

SHA-256 | 57bee9f577390f47d09269171763d581bac37a4751fb81fddb955d4db237ace9

Download | Favorite | View

Related Files

No related files