| |||||||||||||
An important PHP security updateAn important PHP security updatePosted May 3, 2012 23:57 UTC (Thu) by rvolgers (subscriber, #63218)In reply to: An important PHP security update by abadidea Parent article: An important PHP security update
It is. Please see our blog for ongoing updates: http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/
The current PHP patch (which is in the newly released PHP updates) has the following line:
+ if(*decoded_query_string == '-' && strchr(decoded_query_string, '=') == NULL) {
The second decoded_query_string should just be query_string. The current fix can be bypassed by having a %3d sequence in your query string.
(Log in to post comments)
|
|||||||||||||