Description
Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze8 | DSA-2408-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_1.3 | RHSA-2011:1423 |
| RHEL 5 | php +18 | 5.1.6-27.el5_7.4 | RHSA-2012:0033 |
| RHEL 5 | php53 +20 | 5.3.3-1.el5_7.3 | RHSA-2011:1423 |
Advisories 3
- RHSA-2011:1423 Red Hat Security Advisory: php53 and php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2012:0033 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2408-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- HPSBOV02763 vendor-advisory
- http://support.apple.com/kb/HT5130
- 49241 vdb-entry
- [oss-security] 20110313 CVE request: PHP substr_replace() use-after-free mailing-list
- MDVSA-2011:165 vendor-advisory
- [oss-security] 20110313 Re: CVE request: PHP substr_replace() use-after-free mailing-list
- APPLE-SA-2012-02-01-1 vendor-advisory
- [oss-security] 20110313 Re: CVE request: PHP substr_replace() use-after-free mailing-list
- http://bugs.php.net/bug.php?id=54238
- RHSA-2011:1423 vendor-advisory
- http://www.php.net/ChangeLog-5.php#5.3.7
- php-substrreplace-code-exec(66080) vdb-entry
- 46843 vdb-entry
- http://www.php.net/archive/2011.php#id2011-08-18-1