Description
The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze1 | DSA-2195-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny10 | DSA-2195-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-27.el5_5.3 | RHSA-2010:0919 |
| RHEL 4 | php +13 | 4.3.9-3.31 | RHSA-2010:0919 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 5.3.1 - LCG Entropy Security EDB-33677 · dos · Feb 26, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2010:0919 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2195-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2010-0479 vdb-entry
- http://www.php.net/releases/5_2_13.php
- RHSA-2010:0919 vendor-advisory
- http://www.php.net/ChangeLog-5.php
- 38708 third-party-advisory
- 38430 vdb-entry
- 42410 third-party-advisory
- ADV-2010-3081 vdb-entry