SB2018103064 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018103064

SB2018103064 - Multiple vulnerabilities in PHP

Published: October 30, 2018 Updated: June 8, 2025

Security Bulletin ID SB2018103064
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2006-3017)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.


2) Resource management error (CVE-ID: CVE-2006-1991)

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.


Remediation

Install update from vendor's website.

References