diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 532763607ea6..fb9ee7c66884 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -285,19 +285,36 @@ Note: Please add new entries to the beginning of this file. -
-

Ilia Alshanetsky reports lack of safety checks against - integer overflow in Zend Engine II.

+

Stefan Esser reports:

+
+

The PHP 5 branch of the PHP source code lacks the + protection against possible integer overflows inside + ecalloc() that is present in the PHP 4 branch and also for + several years part of our Hardening-Patch and our new + Suhosin-Patch.

+

It was discovered that such an integer overflow can be + triggered when user input is passed to the unserialize() + function. Earlier vulnerabilities in PHP's unserialize() + that were also discovered by one of our audits in December + 2004 are unrelated to the newly discovered flaw, but they + have shown, that the unserialize() function is exposed to + user-input in many popular PHP applications. Examples for + applications that use the content of COOKIE variables with + unserialize() are phpBB and Serendipity.

+

The successful exploitation of this integer overflow will + result in arbitrary code execution.

CVE-2006-4812 + http://www.hardened-php.net/advisory_092006.133.html http://secunia.com/advisories/22280/ 2006-09-30 2006-10-06 + 2006-10-17