CVE-2006-1990: Buffer Overflow

Published Apr 24, 2006

Updated

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.

Affected Software

2 affected components

PHP PHP=5.1.2

PHP PHP=4.4.2

Event History

Apr 24, 2006

CVE Published

11:02 PM

Apr 25, 2006

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-1990?

CVE-2006-1990 is classified as a critical vulnerability due to the potential for arbitrary code execution.

How do I fix CVE-2006-1990?

To fix CVE-2006-1990, upgrade to PHP version 5.1.3 or later and 4.4.3 or later.

What versions of PHP are affected by CVE-2006-1990?

CVE-2006-1990 affects PHP versions 4.4.2 and 5.1.2.

What type of vulnerability is CVE-2006-1990?

CVE-2006-1990 is an integer overflow vulnerability that can lead to a heap-based buffer overflow.

Who can exploit CVE-2006-1990?

CVE-2006-1990 can be exploited by context-dependent attackers who supply specially crafted long arguments.