CVE-2009-3294

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.php.net/bug.php?id=44683Exploit, Vendor Advisory
http://news.php.net/php.announce/79Vendor Advisory
http://svn.php.net/viewvc?view=revision&revision=287779Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/20/1Mailing List, Patch
http://www.openwall.com/lists/oss-security/2009/11/20/2Mailing List
http://www.openwall.com/lists/oss-security/2009/11/20/3Mailing List
http://www.osvdb.org/58188Broken Link
http://www.php.net/ChangeLog-5.phpVendor Advisory
http://www.php.net/ChangeLog-5.php#5.2.11Vendor Advisory
http://www.php.net/releases/5_2_11.phpPatch, Vendor Advisory
http://www.php.net/releases/5_3_1.phpVendor Advisory
http://bugs.php.net/bug.php?id=44683Exploit, Vendor Advisory
http://news.php.net/php.announce/79Vendor Advisory
http://svn.php.net/viewvc?view=revision&revision=287779Vendor Advisory
http://www.openwall.com/lists/oss-security/2009/09/20/1Mailing List, Patch
http://www.openwall.com/lists/oss-security/2009/11/20/2Mailing List
http://www.openwall.com/lists/oss-security/2009/11/20/3Mailing List
http://www.osvdb.org/58188Broken Link
http://www.php.net/ChangeLog-5.phpVendor Advisory
http://www.php.net/ChangeLog-5.php#5.2.11Vendor Advisory
http://www.php.net/releases/5_2_11.phpPatch, Vendor Advisory
http://www.php.net/releases/5_3_1.phpVendor Advisory

Timeline

Published: Sep 22, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-32955.0The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT K CVE-2009-32967.5Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow remote attackers to execute arbitrary code via TIFF images containing CVE-2009-32986.5Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote authenticated institution administrators to reset a site administrator password CVE-2009-32994.3Cross-site scripting (XSS) vulnerability in the resume blocktype in Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote attackers to CVE-2009-33002.6Multiple cross-site scripting (XSS) vulnerabilities in the Identity Provider (IdP) 1.3.x before 1.3.4 and 2.x before 2.1.5, and the Service CVE-2009-33019.3Integer underflow in filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (applica CVE-2009-33029.3filter/ww8/ww8par2.cxx in OpenOffice.org (OOo) before 3.2 allows remote attackers to cause a denial of service (application crash) or possib CVE-2009-33034.3Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbi CVE-2009-33043.3GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' ho CVE-2009-33055.0Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control h CVE-2009-33067.5PHP remote file inclusion vulnerability in include/header.php in ClearSite 4.50 allows remote attackers to execute arbitrary PHP code via a CVE-2009-33077.5Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 allow remote attackers to execute arbitrary PHP code via a URL in the FSPH