CVE-2009-2626
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive...
- Published
- Dec 1, 2009
- Updated
- Sep 16, 2024
- Assigning CNA
- certcc
- Evidence observed
- Aug 10, 2009
Primary CVSS
nvd · CVSS 2.0
AV:N/AC:L/Au:N/C:P/I:N/A:PLow · next 30 days
- Percentile
- 94.8%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
Sources
3Maksymilian Arciemowicz · php · Dec 3, 2009
Maksymilian Arciemowicz · php · Aug 10, 2009
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.