HIGH
security flaw
Published Jul 1, 2005
7.5
HIGHCVSS 2.0
EPSS 79.07%
Description
Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.
Affected products
No data.
Configuration 4
- < 1.8.5
Configuration 5
- 3.1
No data.
Red Hat Enterprise Linux 3
php-0:4.3.2-24.ent
Fixed · RHSA-2005:564
Red Hat Enterprise Linux 4
php-0:4.3.9-3.7
Fixed · RHSA-2005:564
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | php-0:4.3.2-24.ent | Fixed | RHSA-2005:564 |
| Red Hat Enterprise Linux 4 | php-0:4.3.9-3.7 | Fixed | RHSA-2005:564 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (54)
- http://marc.info/?l=bugtraq&m=112008638320145&w=2 mailing-listx_refsource_BUGTRAQThird Party Advisory
- http://marc.info/?l=bugtraq&m=112015336720867&w=2 mailing-listx_refsource_BUGTRAQThird Party Advisory
- http://marc.info/?l=bugtraq&m=112605112027335&w=2 vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://pear.php.net/package/XML_RPC/download/1.3.1 x_refsource_MISCPatchProduct
- http://secunia.com/advisories/15810 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15852 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15855 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15861 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15872 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15883 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15884 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15895 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15903 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15904 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15916 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15917 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15922 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15944 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15947 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/15957 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16001 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16339 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/16693 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/17440 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/17674 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/18003 third-party-advisoryx_refsource_SECUNIABroken Link
- http://security.gentoo.org/glsa/glsa-200507-01.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200507-06.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://security.gentoo.org/glsa/glsa-200507-07.xml vendor-advisoryx_refsource_GENTOOThird Party Advisory
- http://securitytracker.com/id?1015336 vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry
- http://sourceforge.net/project/showfiles.php?group_id=87163 x_refsource_CONFIRMProduct
- http://sourceforge.net/project/shownotes.php?release_id=338803 x_refsource_CONFIRMBroken Link
- http://www.ampache.org/announce/3_3_1_2.php x_refsource_CONFIRMBroken Link
- http://www.debian.org/security/2005/dsa-745 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.debian.org/security/2005/dsa-746 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.debian.org/security/2005/dsa-747 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.debian.org/security/2005/dsa-789 vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory
- http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt x_refsource_CONFIRMThird Party Advisory
- http://www.gulftech.org/?node=research&article_id=00087-07012005 x_refsource_MISCNot ApplicableVendor Advisory
- http://www.hardened-php.net/advisory-022005.php x_refsource_MISCNot Applicable
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:109 vendor-advisoryx_refsource_MANDRAKEPatchThird Party AdvisoryVendor Advisory
- http://www.novell.com/linux/security/advisories/2005_18_sr.html vendor-advisoryx_refsource_SUSEBroken Link
- http://www.novell.com/linux/security/advisories/2005_41_php_pear.html vendor-advisoryx_refsource_SUSEBroken Link
- http://www.novell.com/linux/security/advisories/2005_49_php.html vendor-advisoryx_refsource_SUSEBroken Link
- http://www.redhat.com/support/errata/RHSA-2005-564.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/archive/1/419064/100/0/threaded vendor-advisoryx_refsource_HPBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/14088 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2005/2827 vdb-entryx_refsource_VUPENBroken Link
- https://access.redhat.com/security/cve/CVE-2005-1921 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1617676 Issue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2005-1921
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294 vdb-entrysignaturex_refsource_OVALBroken Link
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350 vdb-entrysignaturex_refsource_OVALBroken Link
- https://www.cve.org/CVERecord?id=CVE-2005-1921
| Link | Providers | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=112008638320145&w=2 | mailing-listx_refsource_BUGTRAQThird Party Advisory | |
| http://marc.info/?l=bugtraq&m=112015336720867&w=2 | mailing-listx_refsource_BUGTRAQThird Party Advisory | |
| http://marc.info/?l=bugtraq&m=112605112027335&w=2 | vendor-advisoryx_refsource_SUSEThird Party Advisory | |
| http://pear.php.net/package/XML_RPC/download/1.3.1 | x_refsource_MISCPatchProduct | |
| http://secunia.com/advisories/15810 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15852 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15855 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15861 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15872 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15883 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15884 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15895 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15903 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15904 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15916 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15917 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15922 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15944 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15947 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/15957 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16001 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16339 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/16693 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/17440 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/17674 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://secunia.com/advisories/18003 | third-party-advisoryx_refsource_SECUNIABroken Link | |
| http://security.gentoo.org/glsa/glsa-200507-01.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://security.gentoo.org/glsa/glsa-200507-06.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://security.gentoo.org/glsa/glsa-200507-07.xml | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| http://securitytracker.com/id?1015336 | vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry | |
| http://sourceforge.net/project/showfiles.php?group_id=87163 | x_refsource_CONFIRMProduct | |
| http://sourceforge.net/project/shownotes.php?release_id=338803 | x_refsource_CONFIRMBroken Link | |
| http://www.ampache.org/announce/3_3_1_2.php | x_refsource_CONFIRMBroken Link | |
| http://www.debian.org/security/2005/dsa-745 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.debian.org/security/2005/dsa-746 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.debian.org/security/2005/dsa-747 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.debian.org/security/2005/dsa-789 | vendor-advisoryx_refsource_DEBIANMailing ListThird Party Advisory | |
| http://www.drupal.org/security/drupal-sa-2005-003/advisory.txt | x_refsource_CONFIRMThird Party Advisory | |
| http://www.gulftech.org/?node=research&article_id=00087-07012005 | x_refsource_MISCNot ApplicableVendor Advisory | |
| http://www.hardened-php.net/advisory-022005.php | x_refsource_MISCNot Applicable | |
| http://www.mandriva.com/security/advisories?name=MDKSA-2005:109 | vendor-advisoryx_refsource_MANDRAKEPatchThird Party AdvisoryVendor Advisory | |
| http://www.novell.com/linux/security/advisories/2005_18_sr.html | vendor-advisoryx_refsource_SUSEBroken Link | |
| http://www.novell.com/linux/security/advisories/2005_41_php_pear.html | vendor-advisoryx_refsource_SUSEBroken Link | |
| http://www.novell.com/linux/security/advisories/2005_49_php.html | vendor-advisoryx_refsource_SUSEBroken Link | |
| http://www.redhat.com/support/errata/RHSA-2005-564.html | vendor-advisoryx_refsource_REDHATBroken Link | |
| http://www.securityfocus.com/archive/1/419064/100/0/threaded | vendor-advisoryx_refsource_HPBroken LinkThird Party AdvisoryVDB Entry | |
| http://www.securityfocus.com/bid/14088 | vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry | |
| http://www.vupen.com/english/advisories/2005/2827 | vdb-entryx_refsource_VUPENBroken Link | |
| https://access.redhat.com/security/cve/CVE-2005-1921 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1617676 | Issue Tracking | |
| https://nvd.nist.gov/vuln/detail/CVE-2005-1921 | ||
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294 | vdb-entrysignaturex_refsource_OVALBroken Link | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350 | vdb-entrysignaturex_refsource_OVALBroken Link | |
| https://www.cve.org/CVERecord?id=CVE-2005-1921 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jul 1, 2005
Updated Aug 7, 2024
Reserved Jun 8, 2005
Link CVE-2005-1921
CISA Vulnrichment
Updated n/a