Description
The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories.
References
- ADV-2007-2732 vdb-entry
- 25056 third-party-advisory
- APPLE-SA-2007-07-31 vendor-advisory
- http://us2.php.net/releases/4_4_7.php
- http://us2.php.net/releases/5_2_2.php
- http://docs.info.apple.com/article.html?artnum=306172
- 25159 vdb-entry
- SUSE-SA:2007:032 vendor-advisory
- http://www.php-security.org/MOPB/MOPB-21-2007.html
- 26235 third-party-advisory
- 22954 vdb-entry