CVE-2009-3294

The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the second argument (aka mode), possibly related to the _fdopen function in the Microsoft C runtime library. NOTE: this might not cross privilege boundaries except in rare cases in which the mode argument is accessible to an attacker outside of an application that uses the popen function.

• CWE-134

• http://bugs.php.net/bug.php?id=44683Exploit, Vendor Advisory
• http://news.php.net/php.announce/79Vendor Advisory
• http://svn.php.net/viewvc?view=revision&revision=287779Vendor Advisory
• http://www.openwall.com/lists/oss-security/2009/09/20/1Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2009/11/20/2Mailing List
• http://www.openwall.com/lists/oss-security/2009/11/20/3Mailing List
• http://www.osvdb.org/58188Broken Link
• http://www.php.net/ChangeLog-5.phpVendor Advisory
• http://www.php.net/ChangeLog-5.php#5.2.11Vendor Advisory
• http://www.php.net/releases/5_2_11.phpPatch, Vendor Advisory
• http://www.php.net/releases/5_3_1.phpVendor Advisory
• http://bugs.php.net/bug.php?id=44683Exploit, Vendor Advisory
• http://news.php.net/php.announce/79Vendor Advisory
• http://svn.php.net/viewvc?view=revision&revision=287779Vendor Advisory
• http://www.openwall.com/lists/oss-security/2009/09/20/1Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2009/11/20/2Mailing List
• http://www.openwall.com/lists/oss-security/2009/11/20/3Mailing List
• http://www.osvdb.org/58188Broken Link
• http://www.php.net/ChangeLog-5.phpVendor Advisory
• http://www.php.net/ChangeLog-5.php#5.2.11Vendor Advisory
• http://www.php.net/releases/5_2_11.phpPatch, Vendor Advisory
• http://www.php.net/releases/5_3_1.phpVendor Advisory

Published

Sep 22, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3288The sg_build_indirect function in drivers/scsi/sg.c in Linux…
• CVE-2009-3289The g_file_copy function in glib 2.0 sets the permissions of…7.8
• CVE-2009-3290The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in …
• CVE-2009-3291The php_openssl_apply_verification_policy function in PHP be…
• CVE-2009-3292Unspecified vulnerability in PHP before 5.2.11, and 5.3.x be…
• CVE-2009-3293Unspecified vulnerability in the imagecolortransparent funct…
• CVE-2009-3295The prep_reprocess_req function in kdc/do_tgs_req.c in the c…
• CVE-2009-3296Multiple integer overflows in tiffread.c in CamlImages 2.2 m…
• CVE-2009-3297Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2009-3298Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote …
• CVE-2009-3299Cross-site scripting (XSS) vulnerability in the resume block…
• CVE-2009-3300Multiple cross-site scripting (XSS) vulnerabilities in the I…