VDB
RHSA-2002:129
RHSA-2002:129
PUBLISHED
CVSS 8.600000381469727 HIGH
PHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail() function, which allows local users and possibly remote attackers to execute arbitrary commands via shell metacharacters.
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux AS (Advanced Server) version 2.1 |
Timeline
- Jun 26, 2002 CVE Published
- Nov 21, 2025 CVE Updated
- Aug 7, 2026 Distribution Patch
- Aug 7, 2026 Distribution Patch
- Aug 7, 2026 Security Advisory
- Aug 7, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2002:129 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2002/rhsa-2002_129.json advisory
- https://access.redhat.com/security/cve/CVE-2001-1246 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1616654 issue
- https://www.cve.org/CVERecord?id=CVE-2001-1246 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2001-1246 advisory