Chain
CVE-2006-7243 family: incomplete fixes (2006–2015)
4 CVEs over 2 generations, 18 Jan 2011 to 9 Jun 2015.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2006-724318 Jan 2011 First in the chain
- CVE-2015-234830 Mar 2015 incomplete fix for CVE-2006-7243
- CVE-2015-40259 Jun 2015 incomplete fix for CVE-2006-7243
- CVE-2015-40269 Jun 2015 incomplete fix for CVE-2006-7243
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2006-7243 | 18 Jan 2011 | PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass… | First in chain | 18.5 |
| CVE-2015-2348 | 30 Mar 2015 | The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and… | CVE-2006-7243 · incomplete fix · High | 19.0 |
| CVE-2015-4025 | 9 Jun 2015 | PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character… | CVE-2006-7243 · incomplete fix · High | 19.4 |
| CVE-2015-4026 | 9 Jun 2015 | The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname… | CVE-2006-7243 · incomplete fix · High | 19.5 |