CVE-2009-4017
Fixed in a distro release EPSS 12%
PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.
Products: php, apple mac_os_x, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 4.0 | php5 | 5.2.0+dfsg-8+etch16 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny4 |
| Red Hat Enterprise Linux 3 | php | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-debuginfo | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-devel | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-imap | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-ldap | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-mysql | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-odbc | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 3 | php-pgsql | 0:4.3.2-54.ent |
| Red Hat Enterprise Linux 4 | php | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-debuginfo | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-devel | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-domxml | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-gd | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-imap | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-ldap | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-mbstring | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-mysql | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-ncurses | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-odbc | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-pear | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-pgsql | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-snmp | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 4 | php-xmlrpc | 0:4.3.9-3.29 |
| Red Hat Enterprise Linux 5 | php | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-bcmath | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-cli | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-common | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-dba | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-debuginfo | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-devel | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-gd | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-imap | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-ldap | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-mbstring | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-mysql | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-ncurses | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-odbc | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-pdo | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-pgsql | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-snmp | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-soap | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-xml | 0:5.1.6-24.el5_4.5 |
| Red Hat Enterprise Linux 5 | php-xmlrpc | 0:5.1.6-24.el5_4.5 |