Most recent entries from all

bdu:2025-11445

2026-10-03T00:24:31.238938+00:00

bdu:2025-11445

BELL-CVE-2024-1874

2026-10-03T00:24:31.238982+00:00

Affected: Alpaquita:23: php81, Alpaquita:stream: php83

BIT-libphp-2024-1874 — Command injection via array-ish $command parameter of proc_open()

2026-10-03T00:24:31.239014+00:00

Affected: Bitnami: libphp

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

certfr-2024-avi-0300 — De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoque…

2026-10-03T00:24:31.239041+00:00

certfr-2024-avi-0300

EUVD-2026-259357

2026-10-03T00:24:31.239058+00:00

EUVD-2026-259357

fkie_cve-2024-1874

2026-10-03T00:24:31.239070+00:00

gsd-2024-1874

2026-10-03T00:24:31.239093+00:00

gsd-2024-1874

HSEC-2024-0003 — process: command injection via argument list on Windows

2026-10-03T00:24:31.239104+00:00

Affected: Hackage: process

# process: command injection via argument list on Windows

The *process* library on Windows is vulnerable to a command injection vulnerability, via `cmd.exe`'s interpretation of arguments. Programs that invoke batch files (`.bat`, `.cmd`) and pass arguments whose values are affected by program inputs may be affected.

This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as **VU#123335** and a coordinated disclosure was made on 2024-04-09 17:00 UTC.

A fix was released in *process-1.6.19.0*.

## Background

Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs.

The *process* library defines the `RawCommand` constructor for specifying an executable and its arguments:

```haskell data CmdSpec = ShellCommand String | RawCommand FilePath [String] ```

On Windows, the `RawCommand` executable name and arguments are serialised into a single *command line* string, with separate arguments quoted separately. *process* then invokes the Windows [`CreateProcess`][doc-CreateProcess] routine with this command line string is given as the `lpCommandLine` argument.

[doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa

## Issue

When executing `.bat` or `.cmd` files, [`CreateProcess`][doc-CreateProcess] implicitly spawns `cmd.exe`. The `System.Process` command lin…

msrc_CVE-2024-1874 — Command injection via array-ish $command parameter of proc_open()

2026-10-03T00:24:31.239165+00:00

msrc_CVE-2024-1874

openSUSE-SU-2024:13867-1 — php8-8.3.6-1.1 on GA media

2026-10-03T00:24:31.239184+00:00

php8-8.3.6-1.1 on GA media

WID-SEC-W-2024-0867 — PHP: Mehrere Schwachstellen

2026-10-03T00:24:31.239201+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in PHP ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.