Ezra Black@Ezra_Black_
i got fired from the php team in 2012 for touching sapi/cgi/cgi_main.c 12 years later, CVE-2012-1823 anyway, does anyone know if wordpress is hiring?
00010239
2.3K followersView on X
CVE-2012-1823(apple / application_stack)
LOWCVSS 9.8 · CRITICALCISA KEVImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
1.0/ 10 priority
Sources & remediation
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-04-15. Apply updates per vendor instructions.
Patch / fix
Exploit / PoC references
Vendor / third-party advisories
- http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2012-0546.html
Other references
Weakness type (CWE)
CWE-77
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- application_stack
- debian_linux
- enterprise_linux_desktop
- enterprise_linux_eus
Affected systems
Products
application_stackdebian_linuxenterprise_linux_desktopenterprise_linux_eusenterprise_linux_serverenterprise_linux_server_ausenterprise_linux_workstationfedoragluster_storage_server_for_on-premisehp-ux
15 versions affected across 17 products
Deep dive
Full discourse1 post
CPE platform detail28 entries
28 of 28 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | apple | mac_os_x | - | - | - |
| OS | debian | debian_linux | 6.0 | - | - |
| OS | fedoraproject | fedora | 39 | - | - |
| OS | fedoraproject | fedora | 40 | - | - |
| OS | hp | hp-ux | b.11.23 | - | - |
| OS | hp | hp-ux | b.11.31 | - | - |
| OS | opensuse | opensuse | 11.4 | - | - |
| OS | opensuse | opensuse | 12.1 | - | - |
| App | php | php | - | - | - |
| App | redhat | application_stack | 2.0 | - | - |
| OS | redhat | enterprise_linux_desktop | 6.0 | - | - |
| OS | redhat | enterprise_linux_eus | 5.6 | - | - |
| OS | redhat | enterprise_linux_eus | 6.1 | - | - |
| OS | redhat | enterprise_linux_eus | 6.2 | - | - |
| OS | redhat | enterprise_linux_server | 5.0 | - | - |
| OS | redhat | enterprise_linux_server | 6.0 | - | - |
| OS | redhat | enterprise_linux_server_aus | 5.3 | - | - |
| OS | redhat | enterprise_linux_server_aus | 5.6 | - | - |
| OS | redhat | enterprise_linux_workstation | 5.0 | - | - |
| OS | redhat | enterprise_linux_workstation | 6.0 | - | - |
| App | redhat | gluster_storage_server_for_on-premise | 2.0 | - | - |
| App | redhat | storage | 2.0 | - | - |
| App | redhat | storage_for_public_cloud | 2.0 | - | - |
| OS | suse | linux_enterprise_server | 10 | - | - |
| OS | suse | linux_enterprise_server | 11 | - | - |
| OS | suse | linux_enterprise_server | 11 | vmware | - |
| OS | suse | linux_enterprise_software_development_kit | 10 | - | - |
| OS | suse | linux_enterprise_software_development_kit | 11 | - | - |