CVE-2006-4812

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

20.38% chance of exploitation in the next 30 days, 97th percentile

Published

2006-10-09

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/28760

Security advisories

• http://rhn.redhat.com/errata/RHSA-2006-0708.html
• http://secunia.com/advisories/22280
• http://www.hardened-php.net/advisory_092006.133.html
• http://securitytracker.com/id?1016984
• http://www.hardened-php.net/files/CVE-2006-4812.patch
• http://www.securityfocus.com/bid/20349
• http://www.ubuntu.com/usn/usn-362-1

References

• CVE Record
• NVD entry