CVE-2006-4020: Medium severity PHP PHP vulnerability

Published Aug 8, 2006

Updated

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Affected Software

67 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Remediation

Patch Available

http://bugs.php.net/bug.php?id=38322

Patch Available

http://www.securityfocus.com/archive/1/442438/30/0/threaded

Event History

Aug 8, 2006

CVE Published

08:04 PM

Aug 9, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-4020?

CVE-2006-4020 has a moderate severity rating as it allows arbitrary code execution through a buffer over-read in certain versions of PHP.

How do I fix CVE-2006-4020?

To fix CVE-2006-4020, upgrade PHP to a version later than 5.1.4 or 4.4.3.

Which PHP versions are affected by CVE-2006-4020?

CVE-2006-4020 affects PHP versions 4.0 and above up to 5.1.4 and 4.4.3.

Can CVE-2006-4020 lead to security vulnerabilities?

Yes, CVE-2006-4020 can lead to significant security vulnerabilities including remote code execution.

What are the implications of CVE-2006-4020 for PHP applications?

The implications of CVE-2006-4020 for PHP applications include the potential for attackers to run arbitrary code, compromising the server's integrity.

CVE-2006-4020: Medium severity PHP PHP vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2006-4020?

How do I fix CVE-2006-4020?

Which PHP versions are affected by CVE-2006-4020?

Can CVE-2006-4020 lead to security vulnerabilities?

What are the implications of CVE-2006-4020 for PHP applications?

Company

Resources

Contact