Description
The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | php5 | 5.2.0-8+etch9 | DSA-1444-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-20.el5_2.1 | RHSA-2008:0544 |
| RHEL 4 | php +13 | 4.3.9-3.22.12 | RHSA-2008:0545 |
| RHEL 3 | php +6 | 4.3.2-48.ent | RHSA-2008:0544 |
| RHEL 2 | php +7 | 4.1.2-2.20 | RHSA-2008:0546 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_jk +1 | 1.2.26-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_perl +1 | 2.0.4-3.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.50sp1a-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-connector-odbc | 3.51.24r1071-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-jdbc | 5.0.8-1jpp.1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.006-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.604-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.6-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.9-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.508-1jpp.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-odbc | 08.02.0500-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresqlclient81 | 8.1.11-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | unixODBC +2 | 2.2.12-8.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.10 | RHSA-2008:0582 |
Advisories 6
- RHSA-2008:0546 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0544 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0545 Red Hat Security Advisory: php security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1444-1 php5 several issues Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2008:0505 Red Hat Security Advisory: Red Hat Application Stack v2.1 security and enhancement update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0582 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 8, 2026
References
- 38918 vdb-entry
- http://www.php.net/ChangeLog-5.php#5.2.5
- https://launchpad.net/bugs/173043
- RHSA-2008:0546 vendor-advisory
- FEDORA-2008-3864 vendor-advisory
- http://bugs.php.net/bug.php?id=42869
- https://issues.rpath.com/browse/RPL-1943
- 30828 third-party-advisory
- DSA-1444 vendor-advisory
- RHSA-2008:0582 vendor-advisory
- USN-628-1 vendor-advisory
- RHSA-2008:0545 vendor-advisory
- 27864 third-party-advisory
- 31124 third-party-advisory
- 31119 third-party-advisory
- 30040 third-party-advisory
- http://www.php.net/releases/5_2_5.php
- 27659 third-party-advisory
- 31200 third-party-advisory
- USN-549-1 vendor-advisory
- SSRT080056 vendor-advisory
- RHSA-2008:0544 vendor-advisory
- 28249 third-party-advisory
- MDVSA-2008:125 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
- RHSA-2008:0505 vendor-advisory
- USN-549-2 vendor-advisory
- MDVSA-2008:126 vendor-advisory
- MDVSA-2008:127 vendor-advisory
- oval:org.mitre.oval:def:11211 vdb-entry signature