PHP "phar/phar_object.c" Format String Vulnerability

Release date:
Updated on:

Affected Systems:
PHP 5.3.x
PHP 5.2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 46854

PHP is a widely used scripting language. It is especially suitable for Web development and can be embedded into HTML.

PHP's "phar/phar_object.c" function has a format string vulnerability. Remote attackers can exploit this vulnerability to bypass certain security restrictions or gain elevated permissions.

This vulnerability is caused by improper filtering before user input is used as a format specifier to a formatted print function.

<* Source: felipe

Link: http://svn.php.net/viewvc? View = revision & revision = 309221
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

PHP
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.php.net