Description
Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl and (2) ext/gd.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 | openSUSE-SU-2024:11167-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Advisories 2
- openSUSE-SU-2024:11167-1 php7-7.4.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 22691 third-party-advisory
- 18198 third-party-advisory
- SSRT061238 vendor-advisory
- 20898 vdb-entry
- 525 third-party-advisory
- 19064 third-party-advisory
- 18054 third-party-advisory
- ADV-2005-2254 vdb-entry
- 16907 vdb-entry
- 17371 third-party-advisory
- ADV-2006-0791 vdb-entry
- ADV-2006-4320 vdb-entry
- APPLE-SA-2006-03-01 vendor-advisory
- SUSE-SA:2005:069 vendor-advisory
- MDKSA-2006:035 vendor-advisory
- 18763 third-party-advisory
- http://www.php.net/release_4_4_1.php
- TA06-062A third-party-advisory
- 15411 vdb-entry
- 17510 third-party-advisory
- OpenPKG-SA-2005.027 vendor-advisory
- GLSA-200511-08 vendor-advisory
- USN-232-1 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=303382