CVE-2005-3390

Name	CVE-2005-3390
Description	The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	336645, 336654, 354680

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php5 (PTS)	jessie, jessie (lts)	5.6.40+dfsg-0+deb8u21	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php4	source	(unstable)	4:4.4.2-1	low		336645, 354680
php5	source	(unstable)	5.1.1-1	low		336654

Notes

[sarge] - php4 <no-dsa> (Operation with register_globals not supported)
http://www.hardened-php.net/advisory_202005.79.html
http://www.hardened-php.net/globals-problem