Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Php | — | Apply OS X security update 2006-007 | Dec 16, 2011 | Apr 24, 2006 |
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Apr 24, 2006 |
| Php | — | Upgrade to PHP version 4.4.3Upgrade to PHP version 5.1.3 | Oct 1, 2012 | Apr 24, 2006 |
| Suse | — | Upgrade php4-develUpgrade apache2-mod_php4Upgrade php4-sysvshmUpgrade php4-pearUpgrade mod_php4-servletUpgrade php4-mbstringUpgrade php4-exifUpgrade php4-sessionUpgrade mod_php4-coreUpgrade apache-mod_php4Upgrade php4-fastcgiUpgrade php4-mysqlUpgrade php4-gdUpgrade php4-imapUpgrade php4-recode | Feb 17, 2015 | Apr 24, 2006 |
| Ubuntu | — | Upgrade php5-cliUpgrade php5-cgiUpgrade libapache2-mod-php4Upgrade libapache2-mod-php5Upgrade php5-curlUpgrade php4-cliUpgrade php4-cgi | Nov 8, 2024 | Apr 24, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub