Description
The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php7 | 7.4.24-1.1 | openSUSE-SU-2024:11167-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Advisories 2
- openSUSE-SU-2024:11167-1 php7-7.4.24-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1015979 vdb-entry
- php-substrcompare-length-dos(26003) vdb-entry
- SUSE-SA:2006:031 vendor-advisory
- MDKSA-2006:091 vendor-advisory
- GLSA-200605-08 vendor-advisory
- 20269 third-party-advisory
- 20676 third-party-advisory
- USN-320-1 vendor-advisory
- 21125 third-party-advisory
- http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02
- ADV-2006-1500 vdb-entry
- 20052 third-party-advisory