PHP 'phar/phar_object.c' Format String Vulnerability

PHP is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers can exploit this issue to run arbitrary code within the context of the PHP process. This may allow them to bypass intended security restrictions or gain elevated privileges.


Privacy Statement
Copyright 2010, SecurityFocus