Date: Thu, 9 Dec 2010 15:38:00 +0100 From: Pierre Joye <pierre.php@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Re: NULL byte poisoning fix in php 5.3.4+ On Thu, Dec 9, 2010 at 3:34 PM, Steven M. Christey <coley@...us.mitre.org> wrote: > > On Thu, 9 Dec 2010, Pierre Joye wrote: > >> We are about to release 5.2.15 and 5.3.4, can anyone please get an id >> for this issue? > > I just assigned CVE-2006-7243 to the http://bugs.php.net/39863 issue, i.e. > NULL injection in file_exists() *only*. > > However, as already stated, the issue of NULL byte injection with PHP dates > back to 1999 or so (ouch... I remember that). If PHP is addressing NULL > byte injection beyond just file_exists(), then that may need a separate CVE. We fixed it for all file functions. See the link to the commit for more details about which codes have been changed. Do we need a CVE for every function? I hope not :) Cheers, -- Pierre @pierrejoye | http://blog.thepimp.net | http://www.libgd.org
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.