Description
Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.5-3+lenny1 | DTSA-135-1 |
| Debian 4.0 | php5 | 5.2.0-8+etch11 | DSA-1572-1 |
Advisories 2
- DSA-1572-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-135-1 php5 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2008-1412 vdb-entry
- 20080523 rPSA-2008-0176-1 php php-cgi php-imap php-mcrypt php-mysql php-mysqli php-pgsql php-soap php-xsl php5 php5-cgi php5-imap php5-mcrypt php5-mysql php5-mysqli php5-pear php5-pgsql php5-soap php5-xsl mailing-list
- 32746 third-party-advisory
- 30083 third-party-advisory
- APPLE-SA-2008-07-31 vendor-advisory
- GLSA-200811-05 vendor-advisory
- 29009 vdb-entry
- ADV-2008-2268 vdb-entry
- DSA-1572 vendor-advisory
- 30345 third-party-advisory
- USN-628-1 vendor-advisory
- php-fastcgisapi-bo(42133) vdb-entry
- 30967 third-party-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0176
- [oss-security] 20080502 CVE Request (PHP) mailing-list
- 30158 third-party-advisory
- http://www.php.net/ChangeLog-5.php
- MDVSA-2009:023 vendor-advisory
- MDVSA-2009:022 vendor-advisory
- 31200 third-party-advisory
- http://cvs.php.net/viewvc.cgi/php-src/sapi/cgi/fastcgi.c?r1=1.44&r2=1.45&diff_format=u
- SSA:2008-128-01 vendor-advisory
- SUSE-SR:2008:014 vendor-advisory
- 31326 third-party-advisory
- https://issues.rpath.com/browse/RPL-2503
- 30048 third-party-advisory