Description
Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.12 | RHSA-2006:0276 |
| RHEL 3 | php +6 | 4.3.2-30.ent | RHSA-2006:0276 |
Advisories 1
- RHSA-2006:0276 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 19355 third-party-advisory
- 21252 third-party-advisory
- USN-261-1 vendor-advisory
- SUSE-SR:2006:004 vendor-advisory
- 18431 third-party-advisory
- 20222 third-party-advisory
- 20210 third-party-advisory
- ADV-2006-0369 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm
- ADV-2006-0177 vdb-entry
- RHSA-2006:0276 vendor-advisory
- 19179 third-party-advisory
- GLSA-200603-22 vendor-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028
- RHSA-2006:0501 vendor-advisory
- RHSA-2006:0549 vendor-advisory
- 18697 third-party-advisory
- 20951 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm
- 19832 third-party-advisory
- oval:org.mitre.oval:def:10064 vdb-entry signature
- MDKSA-2006:028 vendor-advisory
- http://www.php.net/release_5_1_2.php
- 16803 vdb-entry
- 21564 third-party-advisory
- 19012 third-party-advisory
- http://www.php.net/ChangeLog-4.php#4.4.2
- ADV-2006-2685 vdb-entry