PT-2006-2974 · Php+1 · Php+1

Published 2006-04-24 · Updated 2018-10-18 · CVE-2006-1990

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions PHP versions 4.3.11 and prior PHP versions 4.4.2 and prior PHP versions 5.0.5 and prior PHP versions 5.1.3 RC1 and prior

Description The issue is related to multiple problems in PHP, including a buffer overflow error in the wordwrap() function, an error in the array fill() function that can lead to memory exhaustion, and an input validation error in the substr compare() function that can cause a denial of service. These issues could be exploited by remote attackers or malicious users to execute arbitrary commands or exhaust system resources.

Recommendations For PHP versions 4.3.11 and prior, consider upgrading to a newer version to address the vulnerabilities. For PHP versions 4.4.2 and prior, consider upgrading to a newer version to address the vulnerabilities. For PHP versions 5.0.5 and prior, consider upgrading to a newer version to address the vulnerabilities. For PHP versions 5.1.3 RC1 and prior, consider upgrading to a newer version to address the vulnerabilities. As a temporary workaround, consider restricting the use of the wordwrap(), array fill(), and substr compare() functions until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-1990

RHSA-2006:0568

RHSA-2006_0568

Affected Products

Php

Red Hat

References · 48

• 🔥 http://infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02 · Exploit
• ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1990 · Security Note
• http://mandriva.com/security/advisories?name=MDKSA-2006:091 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0568.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_31_php.html · Vendor Advisory
• http://ubuntu.com/usn/usn-320-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0549.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0501.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:122 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200605-08.xml · Vendor Advisory
• http://turbolinux.com/security/2006/TLSA-2006-38.txt · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA06-333A.html · Note
• http://secunia.com/advisories/21252 · Note