CVE-2006-3017: Critical severity PHP PHP vulnerability

Q: What is the severity of CVE-2006-3017?

The severity of CVE-2006-3017 is considered moderate due to potential security implications associated with variable handling in PHP.

Q: How do I fix CVE-2006-3017?

To fix CVE-2006-3017, upgrade to PHP versions 4.4.3, 5.1.3, or higher, where the vulnerability has been patched.

Q: What software versions are affected by CVE-2006-3017?

CVE-2006-3017 affects PHP versions prior to 4.4.3 and 5.1.3 including various versions from 3.0 to 5.0.

Q: What are the potential risks of CVE-2006-3017?

The risks of CVE-2006-3017 include the possibility of using stale variable data, which can compromise security during execution.

Q: How can I identify if my system is vulnerable to CVE-2006-3017?

You can identify if your system is vulnerable by checking the PHP version running on your server and comparing it to the affected versions listed in the CVE description.

Published Jun 14, 2006

Updated

zendhashdelkeyorindex in zendhash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zendhashdel to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.

Affected Software

85 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.0-rc1

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=pl1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

PHP PHP<=4.4.2

Event History

Jun 14, 2006

CVE Published

11:02 PM

Jun 15, 2006

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-3017?

The severity of CVE-2006-3017 is considered moderate due to potential security implications associated with variable handling in PHP.

How do I fix CVE-2006-3017?

To fix CVE-2006-3017, upgrade to PHP versions 4.4.3, 5.1.3, or higher, where the vulnerability has been patched.

What software versions are affected by CVE-2006-3017?