CVE-2006-3017

Published: Jun 14, 2006Modified: Apr 16, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.

Affected (85)

Products: Php: Php

Php

1 product

Php

Configuration A

85 vulnerable

Vulnerable Software	Affected Versions
Php Php	Up to 4.4.2
Php Php	Version 3.0.10
Php Php	Version 3.0.11
Php Php	Version 3.0.12
Php Php	Version 3.0.13
Php Php	Version 3.0.14
Php Php	Version 3.0.15
Php Php	Version 3.0.16
Php Php	Version 3.0.17
Php Php	Version 3.0.18
Php Php	Version 3.0.1
Php Php	Version 3.0.2
Php Php	Version 3.0.3
Php Php	Version 3.0.4
Php Php	Version 3.0.5
Php Php	Version 3.0.6
Php Php	Version 3.0.7
Php Php	Version 3.0.8
Php Php	Version 3.0.9
Php Php	Version 3.0
Php Php	Version 4.0.0
Php Php	Version 4.0.1
Php Php	Version 4.0.1 patch1
Php Php	Version 4.0.1 patch2
Php Php	Version 4.0.2
Php Php	Version 4.0.3
Php Php	Version 4.0.3 patch1
Php Php	Version 4.0.4
Php Php	Version 4.0.4 patch1
Php Php	Version 4.0.5
Php Php	Version 4.0.6
Php Php	Version 4.0.7
Php Php	Version 4.0.7 rc1
Php Php	Version 4.0.7 rc2
Php Php	Version 4.0.7 rc3
Php Php	Version 4.0
Php Php	Version 4.0 beta1
Php Php	Version 4.0 beta2
Php Php	Version 4.0 beta3
Php Php	Version 4.0 beta4
Php Php	Version 4.0 beta_4_patch1
Php Php	Version 4.0 rc1
Php Php	Version 4.0 rc2
Php Php	Version 4.1.0
Php Php	Version 4.1.1
Php Php	Version 4.1.2
Php Php	Version 4.2.0
Php Php	Version 4.2.1
Php Php	Version 4.2.2
Php Php	Version 4.2.3
Php Php	Version 4.2
Php Php	Version 4.3.0
Php Php	Version 4.3.10
Php Php	Version 4.3.11
Php Php	Version 4.3.1
Php Php	Version 4.3.2
Php Php	Version 4.3.3
Php Php	Version 4.3.4
Php Php	Version 4.3.5
Php Php	Version 4.3.6
Php Php	Version 4.3.7
Php Php	Version 4.3.8
Php Php	Version 4.3.9
Php Php	Version 4.4.0
Php Php	Version 4.4.1
Php Php	Version 5.0.0
Php Php	Version 5.0.0 beta1
Php Php	Version 5.0.0 beta2
Php Php	Version 5.0.0 beta3
Php Php	Version 5.0.0 beta4
Php Php	Version 5.0.0 rc1
Php Php	Version 5.0.0 rc2
Php Php	Version 5.0.0 rc3
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.0 rc1
Php Php	Version 5.0 rc2
Php Php	Version 5.0 rc3
Php Php	Version 5.1.0
Php Php	Version 5.1.1
Php Php	Version 5.1.2
Php Php	Version pl1

References (72)

ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U (unsafe URL)

Source: cve@mitre.org

http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0166.html

Source: cve@mitre.org

http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&r1=1.87.4.8.2.1&r2=1.87.4.8.2.2

Source: cve@mitre.org

http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&view=log

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2006-0549.html

Source: cve@mitre.org

http://secunia.com/advisories/19927

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21031

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21050

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21125

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21135

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21202

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21252

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/21723

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22225

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/22713

Source: cve@mitre.org

Vendor Advisory

http://securitytracker.com/id?1016306

Source: cve@mitre.org

http://securitytracker.com/id?1016649

Source: cve@mitre.org

http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm

Source: cve@mitre.org

http://www.debian.org/security/2006/dsa-1206

Source: cve@mitre.org

http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2006:122

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2006_31_php.html

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2006_34_php4.html

Source: cve@mitre.org

http://www.osvdb.org/25255

Source: cve@mitre.org

http://www.osvdb.org/26466

Source: cve@mitre.org

http://www.php.net/release_5_1_3.php

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2006-0567.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2006-0568.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/442437/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/447866/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/17843

Source: cve@mitre.org

http://www.turbolinux.com/security/2006/TLSA-2006-38.txt

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/27396

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-683

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10118

Source: cve@mitre.org

https://usn.ubuntu.com/320-1/

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U (unsafe URL)