CVE-2008-1734
Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers…
Does this matter?
Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own.
Description
Interpretation conflict in PHP Toolkit before 1.0.1 on Gentoo Linux might allow local users to cause a denial of service (PHP outage) and read contents of PHP scripts by creating a file with a one-letter lowercase alphabetic name, which triggers interpretation of a certain unquoted [a-z] argument as a matching shell glob for this name, rather than interpretation as the literal [a-z] regular-expression string, and consequently blocks the launch of the PHP interpreter within the Apache HTTP Server.
- CVSS 2.0
- 3.6 LOWAV:L/AC:L/Au:N/C:P/I:N/A:P
- EPSS
- 0.35% probability · 28th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- gentoo/php toolkit
- Source
- cve@mitre.org
References
- http://bugs.gentoo.org/show_bug.cgi?id=209535
- http://security.gentoo.org/glsa/glsa-200804-19.xml
- http://www.securityfocus.com/bid/28844
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41928
- http://bugs.gentoo.org/show_bug.cgi?id=209535
- http://security.gentoo.org/glsa/glsa-200804-19.xml
- http://www.securityfocus.com/bid/28844
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41928
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.