Description
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny2 | DTSA-188-1 |
Advisories 1
- DTSA-188-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090409 Re: CVE request: PHP 5.2.9 mailing-list
- [oss-security] 20090401 CVE request: PHP 5.2.9 mailing-list
- APPLE-SA-2009-09-10-2 vendor-advisory
- http://www.php.net/releases/5_2_9.php
- http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49
- 35685 third-party-advisory
- SUSE-SR:2009:012 vendor-advisory
- http://support.apple.com/kb/HT3865
- 36701 third-party-advisory
- HPSBMA02447 vendor-advisory