Information disclosure in Php

CVE-2012-1171

The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.

Vulnerability class: Information Disclosure

EPSS: 0.028 (85.1th percentile) — read the EPSS interpretation.

Affected products

  • Php — versions 5.0.0, 5.0.1, 5.0.2
  • N/a — versions n/a

Weakness classification (CWE)

References