Description
Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-15.el5 | RHSA-2007:0890 |
| RHEL 4 | php +13 | 4.3.9-3.22.9 | RHSA-2007:0890 |
| RHEL 3 | php +6 | 4.3.2-43.ent | RHSA-2007:0889 |
| RHEL 2 | php +7 | 4.1.2-2.19 | RHSA-2007:0888 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.8 | RHSA-2007:0891 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.1.6 - 'Chunk_Split()' Integer Overflow EDB-30117 · remote · May 31, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2007:0889 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0890 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0888 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0891 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- 26231 third-party-advisory
- https://launchpad.net/bugs/173043
- 27110 third-party-advisory
- RHSA-2007:0888 vendor-advisory
- 26048 third-party-advisory
- http://www.sec-consult.com/291.html
- SUSE-SA:2008:004 vendor-advisory
- OpenPKG-SA-2007.020 vendor-advisory
- 28750 third-party-advisory
- ADV-2008-0059 vdb-entry
- 28658 third-party-advisory
- FEDORA-2007-709 vendor-advisory
- 26967 third-party-advisory
- 27351 third-party-advisory
- php-chunksplit-security-bypass(39398) vdb-entry
- GLSA-200710-02 vendor-advisory
- 27864 third-party-advisory
- http://www.php.net/releases/4_4_8.php
- 1018186 vdb-entry
- SSA:2008-045-03 vendor-advisory
- 30040 third-party-advisory
- ADV-2008-0398 vdb-entry
- 36083 vdb-entry
- 28936 third-party-advisory
- 26930 third-party-advisory
- FEDORA-2007-2215 vendor-advisory
- 25456 third-party-advisory
- RHSA-2007:0889 vendor-advisory
- 2007-0023 vendor-advisory
- USN-549-1 vendor-advisory
- https://issues.rpath.com/browse/RPL-1693
- ADV-2007-3386 vdb-entry
- SSRT080056 vendor-advisory
- 27037 third-party-advisory
- ADV-2007-2061 vdb-entry
- https://issues.rpath.com/browse/RPL-1702
- 27545 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm
- SSA:2007-152-01 vendor-advisory
- 26838 third-party-advisory
- http://www.php.net/releases/5_2_3.php
- SSRT071447 vendor-advisory
- 27377 third-party-advisory
- 25535 third-party-advisory
- MDKSA-2007:187 vendor-advisory
- http://www.php.net/ChangeLog-4.php
- 27102 third-party-advisory
- 26895 third-party-advisory
- SSRT080010 vendor-advisory
- 28318 third-party-advisory
- USN-549-2 vendor-advisory
- RHSA-2007:0890 vendor-advisory
- RHSA-2007:0891 vendor-advisory
- 26871 third-party-advisory
- 20070601 SEC Consult SA-20070601-0 :: PHP chunk_split() integer overflow mailing-list
- oval:org.mitre.oval:def:9424 vdb-entry signature
- SUSE-SA:2007:044 vendor-advisory
- 24261 vdb-entry