Description
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +26 | 5.3.3-26.el6 | RHSA-2013:1615 |
| RHEL 5 | php +18 | 5.1.6-44.el5_10 | RHSA-2014:0311 |
| RHEL 5 | php53 +20 | 5.3.3-21.el5 | RHSA-2013:1307 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP2 | php53 | 5.3.17-47.1 | SUSE-SU-2016:1638-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Advisories 7
- RHSA-2013:1615 Red Hat Security Advisory: php security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0311 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:1307 Red Hat Security Advisory: php53 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1638-1 Security update for php53 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 44951 vdb-entry
- http://svn.php.net/viewvc?view=revision&revision=305412
- [oss-security] 20101118 Re: NULL byte poisoning fix in php 5.3.4+ mailing-list
- HPSBOV02763 vendor-advisory
- [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ mailing-list
- http://www.php.net/releases/5_3_4.php
- http://svn.php.net/viewvc?view=revision&revision=305507
- http://www.madirish.net/?article=436
- 55078 third-party-advisory
- [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ mailing-list
- APPLE-SA-2011-03-21-1 vendor-advisory
- http://bugs.php.net/39863
- http://www.php.net/ChangeLog-5.php
- [oss-security] 20101118 NULL byte poisoning fix in php 5.3.4+ mailing-list
- RHSA-2013:1307 vendor-advisory
- MDVSA-2010:254 vendor-advisory
- RHSA-2013:1615 vendor-advisory
- http://www.php.net/archive/2010.php#id2010-12-10-1
- SSRT100728 vendor-advisory
- oval:org.mitre.oval:def:12569 vdb-entry signature
- [oss-security] 20101209 Re: Re: NULL byte poisoning fix in php 5.3.4+ mailing-list
- RHSA-2014:0311 vendor-advisory
- FEDORA-2015-8383 vendor-advisory
- FEDORA-2015-8281 vendor-advisory
- FEDORA-2015-8370 vendor-advisory
- http://support.apple.com/kb/HT4581