Explain CVE-2012-0057
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.
Affected Products: n/a
References: [{'name': '[oss-security] 20120115 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/15/1'}, {'name': 'HPSBMU02786', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041'}, {'name': '[oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/13/6'}, {'name': '[oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/13/5'}, {'name': 'DSA-2399', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2399'}, {'name': '[oss-security] 20120117 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/18/3'}, {'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://php.net/ChangeLog-5.php#5.3.9'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': 'SUSE-SU-2012:0472', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html'}, {'name': '[oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/13/7'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'name': '[oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/15/2'}, {'name': '[oss-security] 20120115 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/15/10'}, {'name': '[oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/14/1'}, {'name': '[oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/14/2'}, {'name': 'php-libxslt-security-bypass(72908)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72908'}, {'name': '[oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/14/3'}, {'name': 'SSRT100877', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041'}, {'name': '[oss-security] 20120113 CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/13/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=54446'}, {'name': '[oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/01/13/10'}]
CVE State: PUBLISHED