CVE-2009-0754

{"id": "CVE-2009-0754", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-03-03T16:30:05.233", "references": [{"url": "http://bugs.php.net/bug.php?id=27421", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34642", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34830", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35003", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35007", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35306", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2009/dsa-1789", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/01/30/1", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/02/03/3", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/02/25/3", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2009-0350.html", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1021979", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11035", "source": "cve@mitre.org"}, {"url": "https://usn.ubuntu.com/761-1/", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html", "source": "cve@mitre.org"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-134"}]}], "descriptions": [{"lang": "en", "value": "PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server."}, {"lang": "es", "value": "PHP v4.4.4, v5.1.6, y otras versiones, cuando est\u00e1n ejecutando Apache, permite a usuarios locales modificar el comportamiento de otros sitios hospedados en el mismo servidor web mediante la modificaci\u00f3n de la caracter\u00edstica mbstring.func_overload dentro de .htaccess, lo que produce que esta caracter\u00edstica sea aplicada a otros sistemas virtuales alojados en el mismo servidor."}], "lastModified": "2018-10-03T21:58:38.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71AEE8B4-FCF8-483B-8D4C-2E80A02E925E"}, {"criteria": "cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9BF34B5-F74C-4D56-9841-42452D60CB87"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "754744AE-2EB5-444F-9701-BA1364ED19A7"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}