Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2008-2829

Quick assessment

Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的php_imap.c文件中的rfc822_write_address()函数将返回地址列表的全部长度限定在16383字节，但没有考虑缓冲区大小。如果用户在To:或Cc:字段提供了超长的地址列表的话，就可能触发缓冲区溢出，导致PHP出现SIGABRT而崩溃。以下产品及版本受到影响：PHP 5.2.5版本，5.2.6版本，4.x版本及其他版本。

AI Predicted 7.5 Difficulty: Moderate EPSS 5.27% · P92
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2008-2829

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
PHP php_imap.c文件 rfc822_write_address()函数缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP是广泛使用的通用目的脚本语言，特别适合于Web开发，可嵌入到HTML中。 PHP的php_imap.c文件中的rfc822_write_address()函数将返回地址列表的全部长度限定在16383字节，但没有考虑缓冲区大小。如果用户在To:或Cc:字段提供了超长的地址列表的话，就可能触发缓冲区溢出，导致PHP出现SIGABRT而崩溃。以下产品及版本受到影响：PHP 5.2.5版本，5.2.6版本，4.x版本及其他版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2008-2829

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2008-2829

请登录查看更多情报信息。

Vendor Advisories for CVE-2008-2829 (15)

Mailing List Discussions for CVE-2008-2829 (5)

Other References for CVE-2008-2829 (5)

Same Patch Batch · n/a · 2008-06-23 · 20 CVEs total

CVE-2008-2816 Oxygen 'post.php' SQL注入漏洞
CVE-2008-2825 Xerox WorkCentre/Webserver Pro 内嵌网络服务器跨站脚本攻击漏洞
CVE-2008-2824 Xerox WorkCentre 网页服务可扩展界面平台权限许可和服务控制漏洞
CVE-2008-2823 PHPeasyblog 'newsarchive.php' SQL注入漏洞
CVE-2008-2822 3D-FTP Client FTP客户端多个目录遍历漏洞
CVE-2008-2821 Windows Glub Tech Secure FTP FTP客户端目录遍历漏洞
CVE-2008-2820 Open Azimyt CMS 'lang-system.php' 目录遍历漏洞
CVE-2008-2819 BlognPlus MySQL/PostgreSQL 未明向量SQL注入漏洞
CVE-2008-2818 Easy-Clanpage 默认URI会话目录遍历漏洞
CVE-2008-2817 NITRO Web Gallery 'albums.php' SQL注入漏洞
CVE-2008-2306 Apple Safari 信任站点权限许可和访问控制漏洞
CVE-2008-2815 MyMarket 'index.php' SQL注入漏洞
CVE-2008-2814 Shoutcastadmin Wallcity-server shoutcast 控制面板跨站脚本攻击漏洞
CVE-2008-2813 WallCity-Server Shoutcast 控制面板 'index.php' 目录遍历漏洞
CVE-2008-2828 TMSNC UBX消息远程栈溢出漏洞
CVE-2008-2827 Perl lib/File/Path.pm文件rmtree函数权限许可和服务控制漏洞
CVE-2008-1952 Xen 超虚拟化帧缓冲区ioemu块设备拒绝服务漏洞
CVE-2008-2830 Apple Mac OS X ARDAgent 权限许可和服务控制漏洞
CVE-2008-2307 Apple Safari WebKit JavaScript 缓冲区溢出漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2008-2829

No comments yet

Leave a comment