// For flags

CVE-2006-4812

PHP 3 < 5 - ZendEngine ECalloc Integer Overflow

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).

Desbordamiento de enteros en PHP 5 hasta la 5.1.6 y 4 anteriorer a 4.3.0 permite a un atacante remoto ejecutar código de su elección a través de un argumento a la funcion PHP unserializable con un valor grande para el número de elementos del array, lo cual dispara el desbordamiento en la función ecalloc en Zend Engine (Zend/zend_alloc.c).

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-09-15 CVE Reserved
  • 2006-10-05 First Exploit
  • 2006-10-09 CVE Published
  • 2024-01-13 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (29)
URL Tag Source
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162 X_refsource_confirm
http://secunia.com/advisories/22281 Third Party Advisory
http://secunia.com/advisories/22300 Third Party Advisory
http://secunia.com/advisories/22331 Third Party Advisory
http://secunia.com/advisories/22338 Third Party Advisory
http://secunia.com/advisories/22533 Third Party Advisory
http://secunia.com/advisories/22538 Third Party Advisory
http://secunia.com/advisories/22650 Third Party Advisory
http://securityreason.com/securityalert/1691 Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm X_refsource_confirm
http://support.avaya.com/elmodocs2/security/ASA-2006-234.htm X_refsource_confirm
http://www.securityfocus.com/archive/1/448014/100/0/threaded Mailing List
http://www.securityfocus.com/bid/20349 Vdb Entry
http://www.vupen.com/english/advisories/2006/3922 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/29362 Vdb Entry
URL Date SRC
https://www.exploit-db.com/exploits/28760 2006-10-05
URL Date SRC
http://rhn.redhat.com/errata/RHSA-2006-0708.html 2018-10-30
http://secunia.com/advisories/22280 2018-10-30
http://securitytracker.com/id?1016984 2018-10-30
http://www.hardened-php.net/files/CVE-2006-4812.patch 2018-10-30
URL Date SRC
http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html 2018-10-30
http://rhn.redhat.com/errata/RHSA-2006-0688.html 2018-10-30
http://www.gentoo.org/security/en/glsa/glsa-200610-14.xml 2018-10-30
http://www.hardened-php.net/advisory_092006.133.html 2018-10-30
http://www.securityfocus.com/archive/1/448953/100/0/threaded 2018-10-30
http://www.trustix.org/errata/2006/0055 2018-10-30
http://www.ubuntu.com/usn/usn-362-1 2018-10-30
https://access.redhat.com/security/cve/CVE-2006-4812 2006-10-05
https://bugzilla.redhat.com/show_bug.cgi?id=1618205 2006-10-05
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0
Search vendor "Php" for product "Php" and version "4.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.1
Search vendor "Php" for product "Php" and version "4.0.1"
patch2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.2
Search vendor "Php" for product "Php" and version "4.0.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.3
Search vendor "Php" for product "Php" and version "4.0.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.3
Search vendor "Php" for product "Php" and version "4.0.3"
patch1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.4
Search vendor "Php" for product "Php" and version "4.0.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.5
Search vendor "Php" for product "Php" and version "4.0.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.6
Search vendor "Php" for product "Php" and version "4.0.6"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.0.7
Search vendor "Php" for product "Php" and version "4.0.7"
rc3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.0
Search vendor "Php" for product "Php" and version "4.1.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.1
Search vendor "Php" for product "Php" and version "4.1.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.1.2
Search vendor "Php" for product "Php" and version "4.1.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2
Search vendor "Php" for product "Php" and version "4.2"
dev
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.0
Search vendor "Php" for product "Php" and version "4.2.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.1
Search vendor "Php" for product "Php" and version "4.2.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.2
Search vendor "Php" for product "Php" and version "4.2.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 4.2.3
Search vendor "Php" for product "Php" and version "4.2.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc1
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc2
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0
Search vendor "Php" for product "Php" and version "5.0"
rc3
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.0
Search vendor "Php" for product "Php" and version "5.0.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.1
Search vendor "Php" for product "Php" and version "5.0.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.2
Search vendor "Php" for product "Php" and version "5.0.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.3
Search vendor "Php" for product "Php" and version "5.0.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.4
Search vendor "Php" for product "Php" and version "5.0.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.0.5
Search vendor "Php" for product "Php" and version "5.0.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.0
Search vendor "Php" for product "Php" and version "5.1.0"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.1
Search vendor "Php" for product "Php" and version "5.1.1"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.2
Search vendor "Php" for product "Php" and version "5.1.2"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.3
Search vendor "Php" for product "Php" and version "5.1.3"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.4
Search vendor "Php" for product "Php" and version "5.1.4"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.5
Search vendor "Php" for product "Php" and version "5.1.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.1.6
Search vendor "Php" for product "Php" and version "5.1.6"
-
Affected