Description
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | php4 | 4:4.3.10-18 | DSA-1206-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.15 | RHSA-2006:0568 |
| RHEL 3 | php +6 | 4.3.2-33.ent | RHSA-2006:0568 |
Advisories 2
- RHSA-2006:0568 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1206-1 php4 Debian Security (DSA / DLA) · Mar 9, 2026
References
- 21723 third-party-advisory
- https://issues.rpath.com/browse/RPL-683
- 21252 third-party-advisory
- 21202 third-party-advisory
- http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&view=log
- TLSA-2006-38 vendor-advisory
- http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&r1=1.87.4.8.2.1&r2=1.87.4.8.2.2
- DSA-1206 vendor-advisory
- 21050 third-party-advisory
- SUSE-SA:2006:031 vendor-advisory
- 20060806 PHP: Zend_Hash_Del_Key_Or_Index Vulnerability mailing-list
- 26466 vdb-entry
- 22713 third-party-advisory
- RHSA-2006:0568 vendor-advisory
- 21135 third-party-advisory
- http://www.php.net/release_5_1_3.php
- 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql mailing-list
- 1016649 vdb-entry
- RHSA-2006:0549 vendor-advisory
- 22225 third-party-advisory
- MDKSA-2006:122 vendor-advisory
- 21125 third-party-advisory
- 19927 third-party-advisory
- 25255 vdb-entry
- php-zendhashdel-unspecified(27396) vdb-entry
- 1016306 vdb-entry
- 21031 third-party-advisory
- RHSA-2006:0567 vendor-advisory
- oval:org.mitre.oval:def:10118 vdb-entry signature
- http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html
- http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm
- USN-320-1 vendor-advisory
- 20060806 PHP: Zend_Hash_Del_Key_Or_Index Vulnerability mailing-list
- SUSE-SA:2006:034 vendor-advisory
- 17843 vdb-entry