CVE-2006-2660
Last modified
CVE-2006-2660 is a vulnerability of currently unknown severity. Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Php | Php | 4.0.0 |
| Php | Php | 4.0.1 |
| Php | Php | 4.0.2 |
| Php | Php | 4.0.3 |
| Php | Php | 4.0.4 |
| Php | Php | 4.0.5 |
| Php | Php | 4.1.0 |
| Php | Php | 4.1.1 |
| Php | Php | 4.1.2 |
| Php | Php | 4.2.0 |
| Php | Php | 4.2.1 |
| Php | Php | 4.2.2 |
| Php | Php | 4.2.3 |
| Php | Php | 4.3.0 |
| Php | Php | 4.3.1 |
| Php | Php | 4.3.2 |
| Php | Php | 4.3.3 |
| Php | Php | 4.3.4 |
| Php | Php | 4.3.5 |
| Php | Php | 4.3.6 |
| Php | Php | 4.3.7 |
| Php | Php | 4.3.8 |
| Php | Php | 4.3.9 |
| Php | Php | 4.3.10 |
| Php | Php | 4.3.11 |
| Php | Php | 4.4.0 |
| Php | Php | 4.4.1 |
| Php | Php | 4.4.2 |
| Php | Php | 4.4.3 |
| Php | Php | 5.1.4 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-2660?
How severe is CVE-2006-2660?
How do I fix CVE-2006-2660?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-2654Directory traversal vulnerability in smbfs smbfs on FreeBSD …
- CVE-2006-2655The build process for ypserv in FreeBSD 5.3 up to 6.1 accide…
- CVE-2006-2656Stack-based buffer overflow in the tiffsplit command in libt…
- CVE-2006-2657Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2006-2658Directory traversal vulnerability in the xsp component in mo…
- CVE-2006-2659libs/comverp.c in Courier MTA before 0.53.2 allows attackers…
- CVE-2006-2661ftutil.c in Freetype before 2.2 allows remote attackers to c…
- CVE-2006-2662VMware Server before RC1 does not clear user credentials fro…
- CVE-2006-2663Multiple cross-site scripting (XSS) vulnerabilities in iFlan…
- CVE-2006-2664Cross-site scripting (XSS) vulnerability in iFdate 1.2 allow…
- CVE-2006-2665PHP remote file inclusion vulnerability in includes/mailacce…
- CVE-2006-2666PHP remote file inclusion vulnerability in includes/mailacce…
Are you affected by CVE-2006-2660?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST