Description
Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 2 | php +7 | 4.1.2-2.12 | RHSA-2006:0708 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +16 | 5.1.4-1.el4s1.4 | RHSA-2006:0688 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 3 < 5 - ZendEngine ECalloc Integer Overflow EDB-28760 · remote · Oct 5, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2006:0688 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2006:0708 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 22300 third-party-advisory
- 22650 third-party-advisory
- 1016984 vdb-entry
- 22281 third-party-advisory
- 22338 third-party-advisory
- 20349 vdb-entry
- OpenPKG-SA-2006.023 vendor-advisory
- GLSA-200610-14 vendor-advisory
- 2006-0055 vendor-advisory
- RHSA-2006:0688 vendor-advisory
- USN-362-1 vendor-advisory
- RHSA-2006:0708 vendor-advisory
- 22538 third-party-advisory
- 1691 third-party-advisory
- http://www.hardened-php.net/advisory_092006.133.html
- 22533 third-party-advisory
- http://www.hardened-php.net/files/CVE-2006-4812.patch
- http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm
- php-ecalloc-integer-overflow(29362) vdb-entry
- http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162
- SUSE-SA:2006:059 vendor-advisory
- 20061009 Advisory 09/2006: PHP unserialize() Array Creation Integer Overflow mailing-list
- 22331 third-party-advisory
- ADV-2006-3922 vdb-entry
- 22280 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-234.htm