Description
Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.15 | RHSA-2006:0568 |
| RHEL 3 | php +6 | 4.3.2-33.ent | RHSA-2006:0568 |
Advisories 1
- RHSA-2006:0568 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- ADV-2006-4750 vdb-entry
- 21723 third-party-advisory
- php-wordwrap-string-bo(26001) vdb-entry
- https://issues.rpath.com/browse/RPL-683
- 21252 third-party-advisory
- 1015979 vdb-entry
- 20222 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=304829
- TLSA-2006-38 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm
- 21050 third-party-advisory
- SUSE-SA:2006:031 vendor-advisory
- MDKSA-2006:091 vendor-advisory
- GLSA-200605-08 vendor-advisory
- 20269 third-party-advisory
- RHSA-2006:0568 vendor-advisory
- 21135 third-party-advisory
- 20676 third-party-advisory
- USN-320-1 vendor-advisory
- oval:org.mitre.oval:def:9696 vdb-entry signature
- 19803 third-party-advisory
- 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql mailing-list
- RHSA-2006:0501 vendor-advisory
- 23155 third-party-advisory
- RHSA-2006:0549 vendor-advisory
- 22225 third-party-advisory
- MDKSA-2006:122 vendor-advisory
- 21125 third-party-advisory
- http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02
- APPLE-SA-2006-11-28 vendor-advisory
- ADV-2006-1500 vdb-entry
- TA06-333A third-party-advisory
- 21031 third-party-advisory
- 20052 third-party-advisory
- 21564 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm