|
|
Info |
Last Modified |
| 8 months ago |
|
|
|
|
Description |
PHP 4.x to 4.2.2 contains a flaw that exist in the mail() function that does not properly sanitize user input. It is possible for a user may pass ASCII control characters to the mail() function that could alter the headers of email. This could result in spoofed mail headers.
|
|
Classification |
Unknown or Incomplete
|
|
Technical |
Arbitrary ASCII control characters may be injected into string arguments
of mail() function. If mail() arguments are taken from user's input it
may give the user ability to alter message content including mail
headers.
|
|
Solution |
Upgrade to the latest version of PHP available, or disable the mail() function in the php.ini.
|
|
Products |
|
OpenPKG
 |
1.0 |
1.1 |
1.2 |
|
PHP
|
3.0 |
4.0 |
4.0.1 |
4.0.2 |
4.0.3 |
4.0.4 |
4.0.5 |
4.0.6 |
4.0.7 |
4.1.0 |
4.1.1 |
4.1.2 |
4.2.0 |
4.2.1 |
4.2.2 |
|
|
|
|
|
|
|
Credit |
Unknown or Incomplete
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
