The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade dev-lang/php. | Oct 30, 2017 | Mar 9, 2007 |
| Php | — | Upgrade to PHP version 4.4.5Upgrade to PHP version 5.2.1 | Oct 1, 2012 | Mar 9, 2007 |
| Suse | — | Upgrade php4-mysqlUpgrade php5-bz2Upgrade php5-sysvmsgUpgrade php5-mbstringUpgrade php5-domUpgrade php5-hashUpgrade php4-qtdomUpgrade php5-odbcUpgrade php5-xslUpgrade php5-gmpUpgrade php5-iconvUpgrade php4-readlineUpgrade php5-mcryptUpgrade php5-tidyUpgrade php5-gettextUpgrade php5-mysqlUpgrade php5-fastcgiUpgrade php4-sysvshmUpgrade php5-opensslUpgrade php5-sysvsemUpgrade php5-ftpUpgrade php4-socketsUpgrade php4-ldapUpgrade php4-exifUpgrade php5-mhashUpgrade php4-zlibUpgrade php5-jsonUpgrade apache2-mod_php4Upgrade php5-ncursesUpgrade php4-dbaseUpgrade php4-xsltUpgrade php4-develUpgrade mod_php4-servletUpgrade php5-snmpUpgrade php5-socketsUpgrade php5-pdoUpgrade php5-xmlreaderUpgrade php4-pearUpgrade php4-swfUpgrade php4-sysvsemUpgrade php5-dbaUpgrade php4-ctypeUpgrade php4-bcmathUpgrade php4-shmopUpgrade php4-mime_magicUpgrade php4-gmpUpgrade php4-mcalUpgrade php5-posixUpgrade php5-dbaseUpgrade apache-mod_php4Upgrade php4-gettextUpgrade php4-bz2Upgrade php4-snmpUpgrade php5-pgsqlUpgrade php5-gdUpgrade php5-develUpgrade php4-ftpUpgrade php4-iconvUpgrade php4-curlUpgrade php5-bcmathUpgrade php5-ctypeUpgrade php4-imapUpgrade php4-pgsqlUpgrade php4-unixODBCUpgrade php5-imapUpgrade php5-ldapUpgrade mod_php4-apache2Upgrade php4-fastcgiUpgrade mod_php4-coreUpgrade php5-zlibUpgrade php5-xmlrpcUpgrade php5-tokenizerUpgrade php4-wddxUpgrade php5-pcntlUpgrade php5-sysvshmUpgrade php4-calendarUpgrade php4-domxmlUpgrade php4-mcryptUpgrade php5-suhosinUpgrade suse-releaseUpgrade php4-ypUpgrade php4-dbaUpgrade php4-sessionUpgrade php5-curlUpgrade php4-mbstringUpgrade php5-wddxUpgrade php5-pspellUpgrade php5-zipUpgrade php4-mhashUpgrade php5-sqliteUpgrade apache2-mod_php5 | Feb 17, 2015 | Mar 9, 2007 |
| Ubuntu | — | Upgrade libapache2-mod-php5Upgrade php5-cliUpgrade php5-sqliteUpgrade php5-cgi | Nov 8, 2024 | Mar 10, 2007 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub