CVE-2005-3390

NameCVE-2005-3390
DescriptionThe RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs336645, 336654, 354680

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php4source(unstable)4:4.4.2-1low336645, 354680
php5source(unstable)5.1.1-1low336654

Notes

[sarge] - php4 <no-dsa> (Operation with register_globals not supported)
http://www.hardened-php.net/advisory_202005.79.html
http://www.hardened-php.net/globals-problem

Search for package or bug name: Reporting problems