Description
The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze1 | DSA-2195-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny10 | DSA-2195-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.2-6.el6_0.1 | RHSA-2011:0195 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHP 5.3.3/5.2.14 - ZipArchive::getArchiveComment Null Pointer Dereference EDB-15431 · dos · Nov 5, 2010
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2011:0195 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2195-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2011-0077 vdb-entry
- FEDORA-2010-19011 vendor-advisory
- 42812 third-party-advisory
- HPSBOV02763 vendor-advisory
- HPSBMA02662 vendor-advisory
- MDVSA-2010:218 vendor-advisory
- 20101105 PHP 5.3.3/5.2.14 ZipArchive::getArchiveComment NULL Pointer Deference third-party-advisory
- RHSA-2011:0195 vendor-advisory
- 1024690 vdb-entry
- http://www.php.net/releases/5_3_4.php
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/zip/php_zip.c?view=log
- APPLE-SA-2011-03-21-1 vendor-advisory
- USN-1042-1 vendor-advisory
- 15431 exploit
- ADV-2011-0021 vdb-entry
- http://www.php.net/ChangeLog-5.php
- SSA:2010-357-01 vendor-advisory
- ADV-2010-3313 vdb-entry
- http://www.php.net/archive/2010.php#id2010-12-10-1
- http://www.php.net/releases/5_2_15.php
- FEDORA-2010-18976 vendor-advisory
- http://svn.php.net/viewvc/php/php-src/branches/PHP_5_2/ext/zip/php_zip.c?view=log
- ADV-2011-0020 vdb-entry
- 42729 third-party-advisory
- 44718 vdb-entry
- http://support.apple.com/kb/HT4581