Description
The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 | openSUSE-SU-2024:11167-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Advisories 2
- openSUSE-SU-2024:11167-1 php7-7.4.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2006-0772 vdb-entry
- http://www.php.net/release_5_1_5.php
- 23535 vdb-entry
- 21050 third-party-advisory
- 516 third-party-advisory
- 21546 third-party-advisory
- MDKSA-2006:122 vendor-advisory
- http://bugs.php.net/bug.php?id=37265
- php-imap-restriction-bypass(24964) vdb-entry
- http://www.php.net/ChangeLog-5.php#5.1.5
- 20060228 (PHP) imap functions bypass safemode and open_basedir restrictions mailing-list
- 18694 third-party-advisory