Description
The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories.
References
- ADV-2007-2732 vdb-entry
- 25056 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- http://us2.php.net/releases/4_4_7.php
- http://us2.php.net/releases/5_2_2.php
- http://docs.info.apple.com/article.html?artnum=306172
- 25159 vdb-entry
- http://www.php-security.org/MOPB/MOPB-20-2007.html
- SUSE-SA:2007:032 vendor-advisory
- 26235 third-party-advisory
- 22954 vdb-entry