CVE-2008-5624
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for...
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
Exploit likelihood
What each source reports
NVD Score used
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
- Record
CVE-2008-5624- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
- Record
CVE-2008-5624- Updated
- 2026-11-02
EUVDEUVD-2008-5598 No score
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
- Record
EUVD-2008-5598- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-84wj-6mhh-jgr7 No score
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for...
PHP 5 before 5.2.7 does not properly initialize the page_uid and page_gid global variables for use by the SAPI php_getuid function, which allows context-dependent attackers to bypass safe_mode restrictions via variable settings that are intended to be restricted to root, as demonstrated by a setting of /etc for the error_log variable.
- Record
GHSA-84wj-6mhh-jgr7- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Debian:4.0 From an advisory covering 8 CVEs |
before 5.2.0+dfsg-8+etch15, plus listed versions 5.2.0-105.2.0-10+lenny15.2.0-115.2.0-8+etch15.2.0-8+etch10 Show 12 moreShow less5.2.0-8+etch115.2.0-8+etch11~p15.2.0-8+etch135.2.0-8+etch35.2.0-8+etch45.2.0-8+etch5~pu15.2.0-8+etch65.2.0-8+etch75.2.0-8+etch85.2.0-8+etch95.2.0-8+etch9~bpo31+15.2.0-9 |
5.2.0+dfsg-8+etch15 |
php5Debian:5.0 From an advisory covering 8 CVEs |
before 5.2.6.dfsg.1-1+lenny3, plus listed versions 5.2.6.dfsg.1-1+lenny2 |
5.2.6.dfsg.1-1+lenny3 |
php5Debian:5.0 From an advisory covering 5 CVEs |
before 5.2.6.dfsg.1-1+lenny2 | 5.2.6.dfsg.1-1+lenny2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-5624 is a high vulnerability (CVSS 7.5) in Php, published December 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.22%, the 82nd percentile. No source names a fixed version.
References
marc.info?l=bugtraq&m=125631037611762&w=2
securityfocus.com/archive/1/501376/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/47318
wiki.rpath.com/Advisories:rPSA-2009-0035
Show 11 moreShow less
secunia.com/advisories/35003
php.net/ChangeLog-5.php
mandriva.com/security/advisories?name=MDVSA-2009:045
osvdb.org/50483
securityreason.com/achievement_securityalert/59
debian.org/security/2009/dsa-1789
nvd.nist.gov/vuln/detail/CVE-2008-5624
github.com/advisories/GHSA-84wj-6mhh-jgr7