Description
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "*[1]e" value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-20.el5_2.1 | RHSA-2008:0544 |
| RHEL 4 | php +13 | 4.3.9-3.22.12 | RHSA-2008:0545 |
| RHEL 3 | php +6 | 4.3.2-48.ent | RHSA-2008:0544 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Application Stack 2 | httpd +2 | 2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_jk +1 | 1.2.26-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_perl +1 | 2.0.4-3.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mod_ssl | 1:2.2.8-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql +6 | 5.0.50sp1a-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-connector-odbc | 3.51.24r1071-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | mysql-jdbc | 5.0.8-1jpp.1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBD-MySQL | 4.006-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | perl-DBI | 1.604-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | php +18 | 5.2.6-2.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql +11 | 8.2.9-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-jdbc | 8.2.508-1jpp.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresql-odbc | 08.02.0500-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | postgresqlclient81 | 8.1.11-1.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 2 | unixODBC +2 | 2.2.12-8.el5s2 | RHSA-2008:0505 |
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.10 | RHSA-2008:0582 |
Advisories 4
- RHSA-2008:0544 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0545 Red Hat Security Advisory: php security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0505 Red Hat Security Advisory: Red Hat Application Stack v2.1 security and enhancement update Red Hat Security Advisories (RHSA) · Jan 14, 2026
- RHSA-2008:0582 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jan 8, 2026
References
- FEDORA-2008-3864 vendor-advisory
- SUSE-SA:2008:004 vendor-advisory
- 28658 third-party-advisory
- 30828 third-party-advisory
- RHSA-2008:0582 vendor-advisory
- GLSA-200710-02 vendor-advisory
- USN-628-1 vendor-advisory
- 20070904 PHP < 5.2.3 glob() denial of service mailing-list
- RHSA-2008:0545 vendor-advisory
- 31119 third-party-advisory
- MDVSA-2009:023 vendor-advisory
- MDVSA-2009:022 vendor-advisory
- php-fnmatch-dos(36457) vdb-entry
- 31200 third-party-advisory
- oval:org.mitre.oval:def:10897 vdb-entry signature
- RHSA-2008:0544 vendor-advisory
- 38686 vdb-entry
- php-globfunction-dos(36461) vdb-entry
- 27102 third-party-advisory
- 20070904 PHP < 5.2.3 fnmatch() denial of service mailing-list
- RHSA-2008:0505 vendor-advisory
- 3109 third-party-advisory
- 20070905 PHP < 5.2.3 glob() denial of service mailing-list