Description
Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
References
- 1015485 vdb-entry
- 18431 third-party-advisory
- ADV-2006-0369 vdb-entry
- ADV-2006-0177 vdb-entry
- 20060112 Advisory 02/2006: PHP ext/mysqli Format String Vulnerability mailing-list
- php-extmysqli-format-string(24095) vdb-entry
- http://www.hardened-php.net/advisory_022006.113.html
- 337 third-party-advisory
- 16219 vdb-entry
- http://www.php.net/release_5_1_2.php