Description
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php4 | 6:4.4.4-9+lenny1 | DTSA-40-1 |
| Debian 5.0 | php5 | 5.2.0-10+lenny1 | DTSA-39-1 |
| Debian 4.0 | php4 | 6:4.4.4-8+etch2 | DSA-1282-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch3 | DSA-1283-1 |
| Debian 3.1 | php4 | 4:4.3.10-20 | DSA-1282-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | php +13 | 4.3.9-3.22.4 | RHSA-2007:0155 |
| RHEL 3 | php +6 | 4.3.2-40.ent | RHSA-2007:0155 |
| RHEL 2 | php +7 | 4.1.2-2.17 | RHSA-2007:0154 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Stronghold 4 | stronghold-php +8 | 4.1.2-15 | RHSA-2007:0163 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)
exploit/multi/php/php_unserialize_zval_cookie
Exploit-DB 3
- PHP 4 - Unserialize() ZVAL Reference Counter Overflow (Cookie) (Metasploit) EDB-16310 · remote · Sep 20, 2010 · verified
- PHP 4.4.4 - 'Unserialize()' ZVAL Reference Counter Overflow (PoC) EDB-3396 · dos · Mar 2, 2007 · verified
- PHP < 4.5.0 - Unserialize Overflow (Metasploit) EDB-9939 · remote · Mar 1, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2007:0163 Red Hat Security Advisory: php security update for Stronghold Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0155 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0154 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DTSA-40-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1282-1 php4 Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1283-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
References
- 2007-0009 vendor-advisory
- ADV-2007-1991 vdb-entry
- DSA-1283 vendor-advisory
- SSRT071423 vendor-advisory
- 24606 third-party-advisory
- RHSA-2007:0154 vendor-advisory
- 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql mailing-list
- GLSA-200705-19 vendor-advisory
- 24941 third-party-advisory
- HPSBTU02232 vendor-advisory
- GLSA-200703-21 vendor-advisory
- php-zval-code-execution(32796) vdb-entry
- 25062 third-party-advisory
- ADV-2007-2374 vdb-entry
- 25423 third-party-advisory
- http://www.php-security.org/MOPB/MOPB-04-2007.html
- 24419 third-party-advisory
- MDKSA-2007:087 vendor-advisory
- 24945 third-party-advisory
- DSA-1282 vendor-advisory
- https://issues.rpath.com/browse/RPL-1268
- 24924 third-party-advisory
- RHSA-2007:0155 vendor-advisory
- 24910 third-party-advisory
- 25850 third-party-advisory
- 25445 third-party-advisory
- RHSA-2007:0163 vendor-advisory
- oval:org.mitre.oval:def:11575 vdb-entry signature
- 22765 vdb-entry
- 25025 third-party-advisory
- 32771 vdb-entry
- MDKSA-2007:088 vendor-advisory