CVE-2008-0599

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-05-05 · updated 2026-06-16
Weakness: CWE-131

Description

The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

Affected products

macOS: before 10.5.4 — fixed in 10.5.4
Apple Mac Os X Server: before 10.5.4 — fixed in 10.5.4
Canonical Ubuntu Linux: 6.06, 7.04, 7.10, 8.04
Fedoraproject Fedora: 8, 9
PHP: before 5.2.6 — fixed in 5.2.6

How to fix

Upgrade to a fixed version: macOS 10.5.4; Apple Mac Os X Server 10.5.4; PHP 5.2.6. Check the vendor advisory for mitigations.

References

http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/cgi_main.c?r1=1.267.2.15.2.50.2.12&r2=1.267.2.15.2.50.2.13&diff_format=u
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01476437
http://lists.apple.com/archives/security-announce//2008/Jul/msg00003.html
http://marc.info/?l=bugtraq&m=124654546101607&w=2
http://marc.info/?l=bugtraq&m=125631037611762&w=2
http://secunia.com/advisories/30048
http://secunia.com/advisories/30083
http://secunia.com/advisories/30345
http://secunia.com/advisories/30616
http://secunia.com/advisories/30757
http://secunia.com/advisories/30828
http://secunia.com/advisories/31200

Get alerted when CVE-2008-0599 or the next vulnerability affects your stack