CVE-2006-4812: Code Injection
Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zendalloc.c).
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-4812?
CVE-2006-4812 has been classified as a critical severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2006-4812?
To fix CVE-2006-4812, it is recommended to update PHP to a version higher than 5.1.6 or 4.3.0.
What versions of PHP are affected by CVE-2006-4812?
CVE-2006-4812 affects PHP versions 5.1.6 and earlier, as well as version 4.2.3 and earlier.
What exploit techniques can be used with CVE-2006-4812?
Attacks exploiting CVE-2006-4812 typically involve providing a large input to the unserialize function that results in an integer overflow.
Who can be affected by CVE-2006-4812?
Any application using vulnerable versions of PHP that allow untrusted data to be passed to the unserialize function could be affected by CVE-2006-4812.