CVE-2008-0599: apple mac_os_x Incorrect Calculation of Buffer Size
Vulnerability summary
CVE-2008-0599 is a high (CVSS 10.0) Incorrect Calculation of Buffer Size vulnerability in apple mac_os_x. EPSS estimates a 10.92% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 05-05-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
10.92%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
No change 0.00 pp
From 10.92% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (cvs.php.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Apple2 products
- mac_os_x< 10.5.4
- mac_os_x_server< 10.5.4
Canonical1 product
- ubuntu_linuxEOL6.06 | 7.04 | 7.10 | 8.04
Fedoraproject1 product
- fedoraEOL8 | 9
Php1 product
- php< 5.2.6
4 vendors · 5 products
References
36 links- www.securityfocus.com/archive/1/492535/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- www.redhat.com/archives/fedora-package-announce/2008-June/msg00779.htmlVendor AdvisoryX Refsource FEDORAMailing List
- h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01476437Vendor AdvisoryX Refsource HPBroken Link
- lists.apple.com/archives/security-announce//2008/Jul/msg00003.htmlVendor AdvisoryX Refsource APPLEMailing List
Show all 36 references
- www.redhat.com/archives/fedora-package-announce/2008-June/msg00773.htmlVendor AdvisoryX Refsource FEDORAMailing List
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5510VDB EntrySignatureX Refsource OVALBroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2008:128Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.488951Vendor AdvisoryX Refsource SLACKWAREBroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2008:127Vendor AdvisoryX Refsource MANDRIVABroken Link