CVE-2006-4625
LOW severity · CVSS 3.6
3.6CVSS LOW
Summary
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impactNone
Exploit probability (EPSS)1%
AV:L/AC:L/Au:N/C:P/I:P/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137
- http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html
- http://secunia.com/advisories/22282
- http://secunia.com/advisories/22331
- http://secunia.com/advisories/22338
- http://secunia.com/advisories/22424
- http://secunia.com/advisories/25423