Description
The mb_parse_str function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal register_globals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with register_globals functionality that is not detectable by these scripts, as demonstrated by forcing a memory_limit violation.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php4 | 6:4.4.4-9+lenny1 | DTSA-40-1 |
| Debian 5.0 | php5 | 5.2.0-10+lenny1 | DTSA-39-1 |
| Debian 4.0 | php4 | 6:4.4.4-8+etch2 | DSA-1282-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch3 | DSA-1283-1 |
| Debian 3.1 | php4 | 4:4.3.10-20 | DSA-1282-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-11.el5 | RHSA-2007:0153 |
| RHEL 4 | php +13 | 4.3.9-3.22.4 | RHSA-2007:0155 |
| RHEL 3 | php +6 | 4.3.2-40.ent | RHSA-2007:0155 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.6 | RHSA-2007:0162 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 5.1.6 - Mb_Parse_Str Function Register_Globals Activation EDB-29752 · remote · Mar 19, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2007:0162 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0155 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0153 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-40-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1282-1 php4 Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1283-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2007-2732 vdb-entry
- 25056 third-party-advisory
- DSA-1283 vendor-advisory
- 20070418 rPSA-2007-0073-1 php php-mysql php-pgsql mailing-list
- APPLE-SA-2007-07-31 vendor-advisory
- GLSA-200705-19 vendor-advisory
- oval:org.mitre.oval:def:10245 vdb-entry signature
- RHSA-2007:0162 vendor-advisory
- 23016 vdb-entry
- http://us2.php.net/releases/4_4_7.php
- 25062 third-party-advisory
- MDKSA-2007:090 vendor-advisory
- USN-455-1 vendor-advisory
- 24909 third-party-advisory
- 24945 third-party-advisory
- https://issues.rpath.com/browse/RPL-1268
- http://us2.php.net/releases/5_2_2.php
- http://docs.info.apple.com/article.html?artnum=306172
- 24924 third-party-advisory
- RHSA-2007:0155 vendor-advisory
- 24965 third-party-advisory
- 25159 vdb-entry
- MDKSA-2007:089 vendor-advisory
- 25445 third-party-advisory
- http://www.php-security.org/MOPB/MOPB-26-2007.html
- 25057 third-party-advisory
- SUSE-SA:2007:032 vendor-advisory
- MDKSA-2007:088 vendor-advisory
- 26235 third-party-advisory
- RHSA-2007:0153 vendor-advisory