Description
CRLF injection vulnerability in the ftp_putcmd function in PHP before 4.4.7, and 5.x before 5.2.2 allows remote attackers to inject arbitrary FTP commands via CRLF sequences in the parameters to earlier FTP commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php4 | 6:4.4.4-9+lenny1 | DTSA-40-1 |
| Debian 5.0 | php5 | 5.2.0-10+lenny1 | DTSA-39-1 |
| Debian 4.0 | php4 | 6:4.4.4-8+etch3 | DSA-1296-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch4 | DSA-1295-1 |
| Debian 3.1 | php4 | 4:4.3.10-21 | DSA-1296-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-12.el5 | RHSA-2007:0348 |
| RHEL 4 | php +13 | 4.3.9-3.22.5 | RHSA-2007:0349 |
| RHEL 3 | php +6 | 4.3.2-43.ent | RHSA-2007:0889 |
| RHEL 2 | php +7 | 4.1.2-2.19 | RHSA-2007:0888 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.7 | RHSA-2007:0355 |
Advisories 9
- RHSA-2007:0889 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0888 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0349 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0348 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1296-1 php4 Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-40-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1295-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0355 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 25660 third-party-advisory
- MDKSA-2007:103 vendor-advisory
- 25187 third-party-advisory
- 25191 third-party-advisory
- USN-462-1 vendor-advisory
- ADV-2007-2187 vdb-entry
- RHSA-2007:0888 vendor-advisory
- MDKSA-2007:102 vendor-advisory
- 26048 third-party-advisory
- DSA-1296 vendor-advisory
- RHSA-2007:0355 vendor-advisory
- GLSA-200705-19 vendor-advisory
- 26967 third-party-advisory
- 27351 third-party-advisory
- 2007-0017 vendor-advisory
- 23818 vdb-entry
- 23813 vdb-entry
- http://us2.php.net/releases/4_4_7.php
- RHSA-2007:0349 vendor-advisory
- DSA-1295 vendor-advisory
- 25318 third-party-advisory
- php-ftpputcmd-crlf-injection(34413) vdb-entry
- 20070323 CRLF injection in PHP ftp function mailing-list
- RHSA-2007:0889 vendor-advisory
- http://us2.php.net/releases/5_2_2.php
- 25365 third-party-advisory
- 2672 third-party-advisory
- 25255 third-party-advisory
- 25445 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-231.htm
- 25372 third-party-advisory
- oval:org.mitre.oval:def:10839 vdb-entry signature
- 1018022 vdb-entry
- RHSA-2007:0348 vendor-advisory
- SUSE-SA:2007:044 vendor-advisory