#VU110479 Input validation error in PHP - CVE-2006-4020

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU110479

#VU110479 Input validation error in PHP - CVE-2006-4020

Published: February 14, 2024 / Updated: June 12, 2025


Vulnerability identifier: #VU110479
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2006-4020
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: Public exploit is available
Vulnerable software:
PHP
Software vendor:
PHP Group

Description

The vulnerability allows a local user to read and manipulate data.

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.


Remediation

Install update from vendor's website.

External links