Bug 111014

Summary:	dev-lang/php // dev-php/php <= 4.4.0, <= 5.0.5 register_globals Activation Vulnerability in parse_str()
Product:	Gentoo Security	Reporter:	Vic Fryzel (shellsage) (RETIRED) <shellsage>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	minor
Priority:	High
Version:	unspecified
Hardware:	All
OS:	All
URL:	http://www.hardened-php.net/advisory_192005.78.html
Whiteboard:
Package list:		Runtime testing required:	---

Description Vic Fryzel (shellsage) (RETIRED) gentoo-dev

2005-10-31 06:23:38 UTC

When parse_str() is called with only one parameter it parses the supplied
string, as if it were the query string passed via a URL and sets variables in
the global scope. This is achieved by internally switching register_globals on,
while the string is parsed.

For more details see original advisory:
http://www.hardened-php.net/advisory_192005.78.html

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1 Thierry Carrez (RETIRED) gentoo-dev

2005-10-31 13:33:43 UTC

Regrouping issues...

*** This bug has been marked as a duplicate of 111032 ***