| Package | Affected versions | Patched versions |
|---|---|---|
| php | < 5.2.6 | 5.2.6 |
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free