CVE-2006-4812

Published: Oct 10, 2006Modified: Apr 23, 2026

10.0

Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 10.0 / Impact: 10.0

Source: NVD

Description

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).

Affected (38)

Products: Php: Php

Php

1 product

Php

Configuration A

38 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 4.0.1
Php Php	Version 4.0.1 patch1
Php Php	Version 4.0.1 patch2
Php Php	Version 4.0.2
Php Php	Version 4.0.3
Php Php	Version 4.0.3 patch1
Php Php	Version 4.0.4
Php Php	Version 4.0.5
Php Php	Version 4.0.6
Php Php	Version 4.0.7
Php Php	Version 4.0.7 rc1
Php Php	Version 4.0.7 rc2
Php Php	Version 4.0.7 rc3
Php Php	Version 4.0
Php Php	Version 4.1.0
Php Php	Version 4.1.1
Php Php	Version 4.1.2
Php Php	Version 4.2.0
Php Php	Version 4.2.1
Php Php	Version 4.2.2
Php Php	Version 4.2.3
Php Php	Version 4.2
Php Php	Version 5.0.0
Php Php	Version 5.0.1
Php Php	Version 5.0.2
Php Php	Version 5.0.3
Php Php	Version 5.0.4
Php Php	Version 5.0.5
Php Php	Version 5.0 rc1
Php Php	Version 5.0 rc2
Php Php	Version 5.0 rc3
Php Php	Version 5.1.0
Php Php	Version 5.1.1
Php Php	Version 5.1.2
Php Php	Version 5.1.3
Php Php	Version 5.1.4
Php Php	Version 5.1.5
Php Php	Version 5.1.6

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (52)

http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162

Source: secalert@redhat.com

http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2006-0688.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2006-0708.html

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/22280

Source: secalert@redhat.com

PatchVendor Advisory

http://secunia.com/advisories/22281

Source: secalert@redhat.com

http://secunia.com/advisories/22300

Source: secalert@redhat.com

http://secunia.com/advisories/22331

Source: secalert@redhat.com

http://secunia.com/advisories/22338

Source: secalert@redhat.com

http://secunia.com/advisories/22533

Source: secalert@redhat.com

http://secunia.com/advisories/22538

Source: secalert@redhat.com

http://secunia.com/advisories/22650

Source: secalert@redhat.com

http://securityreason.com/securityalert/1691

Source: secalert@redhat.com

http://securitytracker.com/id?1016984

Source: secalert@redhat.com

Patch

http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm

Source: secalert@redhat.com

http://support.avaya.com/elmodocs2/security/ASA-2006-234.htm

Source: secalert@redhat.com

http://www.gentoo.org/security/en/glsa/glsa-200610-14.xml

Source: secalert@redhat.com

http://www.hardened-php.net/advisory_092006.133.html

Source: secalert@redhat.com

Vendor Advisory

http://www.hardened-php.net/files/CVE-2006-4812.patch

Source: secalert@redhat.com

Patch

http://www.securityfocus.com/archive/1/448014/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/448953/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/20349

Source: secalert@redhat.com

http://www.trustix.org/errata/2006/0055

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-362-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2006/3922

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/29362

Source: secalert@redhat.com

http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162