Description
Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | php4 | 6:4.4.4-8+etch4 | DSA-1331-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch7 | DSA-1330-1 |
| Debian 3.1 | php4 | 4:4.3.10-22 | DSA-1331-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-12.el5 | RHSA-2007:0348 |
| RHEL 4 | php +13 | 4.3.9-3.22.5 | RHSA-2007:0349 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.7 | RHSA-2007:0355 |
Advisories 5
- RHSA-2007:0349 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0348 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1331-1 php4 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1330-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2007:0355 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 25660 third-party-advisory
- MDKSA-2007:103 vendor-advisory
- 25187 third-party-advisory
- 25191 third-party-advisory
- ADV-2007-2187 vdb-entry
- MDKSA-2007:102 vendor-advisory
- 26048 third-party-advisory
- RHSA-2007:0355 vendor-advisory
- oval:org.mitre.oval:def:11257 vdb-entry signature
- GLSA-200705-19 vendor-advisory
- 2007-0017 vendor-advisory
- 23813 vdb-entry
- http://us2.php.net/releases/4_4_7.php
- RHSA-2007:0349 vendor-advisory
- DSA-1331 vendor-advisory
- https://issues.rpath.com/browse/RPL-1693
- DSA-1330 vendor-advisory
- http://us2.php.net/releases/5_2_2.php
- USN-485-1 vendor-advisory
- 27377 third-party-advisory
- 25945 third-party-advisory
- 25255 third-party-advisory
- 26102 third-party-advisory
- 25445 third-party-advisory
- 1018024 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2007-231.htm
- 34674 vdb-entry
- RHSA-2007:0348 vendor-advisory
- 25938 third-party-advisory
- SUSE-SA:2007:044 vendor-advisory