Maksymilian Arciemowicz has reported some vulnerabilities in PHP, which can be exploited by malicious, local users to bypass certain security restrictions and by malicious people to conduct cross-site scripting attacks.

1) The "phpinfo()" PHP function only sanitises the first 4096 characters of an array request parameter before it is returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site via a script calling "phpinfo()".

2) An error in the "tempnam()" PHP function can be exploited to bypass the "open_basedir" directive and create temporary files in arbitrary directories via directory traversal attacks.

3) An error in the "copy()" PHP function can be exploited to bypass the safe mode protection mechanism and access files outside the "open_basedir" root via the "compress.zlib://" file wrapper.

The vulnerabilities have been reported in versions 4.4.2 and 5.1.2, and prior.

Solution
Update to version 4.4.3, 5.1.3, or 5.2.0.
Further details available in Customer Area

Provided and/or discovered by
Maksymilian Arciemowicz

Changelog
Further details available in Customer Area

Original Advisory
http://securityreason.com/achievement_securityalert/34
http://securityreason.com/achievement_securityalert/36
http://securityreason.com/achievement_securityalert/37

Deep Links
Links available in Customer Area