Home » 2009 » December » 3 » [oCERT-2009-017] PHP multiple issues
7:43 AM
[oCERT-2009-017] PHP multiple issues

#2009-017 PHP multiple issues


PHP, an open source scripting language, suffers from several bugs that may
pose a security risk.

The reported issues have been discovered in several API functions, issues
include buffer overflows, near null reads/writes, arbitrary memory read
and an off-by-one issue. Some of the issues have been previously reported
in older versions of PHP but they either have not been fixed or they were
re-introduced in a later time. The issues have been discovered in both
core and, in some cases, PECL functions/classes/methods.

The following methods have been fixed.


The following methods have been removed in PHP 5.3, they are still
available without fixes in 5.2.11.


Affected version:

PHP < 5.3.1

Fixed version:

PHP >= 5.3.1

Credit: vulnerability report received from Emmanouel Kellinis, KPMG London.



2009-07-10: vulnerability report received
2009-07-15: contacted PHP security team
2009-07-15: vendor provides initial feedback, classifies the security
           impact as low
2009-08-09: oCERT asks for feedback about the timescale for eventual fixes
2009-08-24: vendor replies that most issues will not be fixed as they are
           present in deprecated extensions or are not understood
2009-08-25: reporter offers to clarify all the issues and provides test
2009-08-26: after reporter feedback vendor commits more fixes
2009-10-05: reporter asks clarification about fixed/pending bugs
2009-10-27: after further reporter feedback vendor commits more fixes
2009-11-30: advisory published



Andrea Barisani |                Founder & Project Coordinator
         oCERT | Open Source Computer Emergency Response Team

<lcars@ocert.org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
       "Pluralitas non est ponenda sine necessitate"
Views: 498 | Added by: b1zz4rd | Rating: 0.0/0
Total comments: 0
Name *:
Email *:
Code *: