CVE-2013-1635

Description (CNA)

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.

Affected (CNA)

CWE

No CWE identifiers supplied.

References

• http://git.php.net/?p=php-src.git%3Ba=blob%3Bf=NEWS%3Bh=82afa3a040e639f3595121e45b850d5453906a00%3Bhb=refs/heads/PHP-5.3
• https://bugs.gentoo.org/show_bug.cgi?id=459904
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:114
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221
• https://bugzilla.redhat.com/show_bug.cgi?id=918196
• http://www.debian.org/security/2013/dsa-2639
• http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00034.html
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101
• http://support.apple.com/kb/HT5880
• http://git.php.net/?p=php-src.git%3Ba=blob%3Bf=NEWS%3Bh=36f6f9a4396d3034cc903a4271e7fdeccc5d3ea6%3Bhb=refs/heads/PHP-5.4
• http://git.php.net/?p=php-src.git%3Ba=commitdiff%3Bh=702b436ef470cc02f8e2cc21f2fadeee42103c74

ADP enrichment