#VU110468 Code Injection in PHP - CVE-2006-4812

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU110468

#VU110468 Code Injection in PHP - CVE-2006-4812

Published: October 30, 2018 / Updated: June 9, 2025


Vulnerability identifier: #VU110468
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2006-4812
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
PHP
Software vendor:
PHP Group

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).


Remediation

Install update from vendor's website.

External links