Improper Input Validation Affecting php-imap package, versions <0:5.3.3-3.el6_2.8


Severity

Recommended
critical

Based on CentOS security rating.

Threat Intelligence

Exploit Maturity
Mature
EPSS
95.14% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Input Validation vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS6-PHPIMAP-2055301
  • published26 Jul 2021
  • disclosed3 May 2012

Introduced: 3 May 2012

CVE-2012-1823  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade Centos:6 php-imap to version 0:5.3.3-3.el6_2.8 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream php-imap package and not the php-imap package as distributed by Centos. See How to fix? for Centos:6 relevant fixed versions and status.

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

References

CVSS Scores

version 3.1