Description
PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny6 | DSA-2001-1 |
Advisories 1
- DSA-2001-1 php5 - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.php.net/releases/5_2_12.php
- 40262 third-party-advisory
- 37390 vdb-entry
- HPSBUX02543 vendor-advisory
- 37821 third-party-advisory
- 38648 third-party-advisory
- APPLE-SA-2010-03-29-1 vendor-advisory
- 41490 third-party-advisory
- HPSBMA02568 vendor-advisory
- http://www.php.net/ChangeLog-5.php
- MDVSA-2010:045 vendor-advisory
- http://support.apple.com/kb/HT4077
- ADV-2009-3593 vdb-entry
- DSA-2001 vendor-advisory
- 41480 third-party-advisory
- oval:org.mitre.oval:def:7439 vdb-entry signature