PT-2006-5282 · Php+1 · Php+1

Published 2006-08-31 · Updated 2022-07-19 · CVE-2006-4482

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.1.5

Description Multiple heap-based buffer overflows in the str repeat and wordwrap functions in ext/standard/string.c have unspecified impact and attack vectors when used on a 64-bit system. These overflows could be exploited by attackers or malicious users to execute arbitrary commands.

Recommendations For PHP versions prior to 5.1.5, update to version 5.1.5 or later to resolve the issue. As a temporary workaround, consider disabling the str repeat and wordwrap functions until a patch is available. Restrict access to the ext/standard/string.c module to minimize the risk of exploitation. Avoid using the affected functions in sensitive operations until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2006-4482

DSA-1206-1

RHSA-2006:0669

RHSA-2006:0688

RHSA-2006_0669

Affected Products

Php

Red Hat

References · 45

• http://php.net/release_5_1_5.php · Vendor Advisory
• http://secunia.com/advisories/21768 · Vendor Advisory
• http://turbolinux.com/security/2006/TLSA-2006-38.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0669.html · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_52_php.html · Vendor Advisory
• http://secunia.com/advisories/22069 · Vendor Advisory
• http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11 · Patch
• http://secunia.com/advisories/21546 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2006-0688.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4482 · Security Note
• http://redhat.com/support/errata/RHSA-2006-0682.html · Vendor Advisory
• http://secunia.com/advisories/22225 · Vendor Advisory
• http://ubuntu.com/usn/usn-342-1 · Vendor Advisory
• http://php.net/ChangeLog-5.php#5.1.5 · Vendor Advisory