Date Reported:
16 Jul 2003
Affected Packages:
php4
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CAN-2003-0442.
More information:

The transparent session ID feature in the php4 package does not properly escape user-supplied input before inserting it into the generated HTML page. An attacker could use this vulnerability to execute embedded scripts within the context of the generated page.

For the stable distribution (woody) this problem has been fixed in version 4:4.1.2-6woody3.

For the unstable distribution (sid) this problem will be fixed soon. Refer to Debian bug #200736.

We recommend that you update your php4 package.

• Read full article
• Read full article in new window
• See other articles published by Debian.org
• Today's headlines
• Headlines for Jul 17, 2003