Description
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze5 | DSA-2399-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny14 | DSA-2399-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_1.3 | RHSA-2011:1423 |
| RHEL 5 | php53 +20 | 5.3.3-1.el5_7.3 | RHSA-2011:1423 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- PHP 5.3.6 - Local Buffer Overflow (ROP) EDB-17486 · local · Jul 4, 2011 · verified
- PHP 5.3.5 - 'socket_connect()' Local Buffer Overflow EDB-17318 · local · May 25, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2011:1423 Red Hat Security Advisory: php53 and php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2399-1 php5 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://svn.php.net/viewvc?view=revision&revision=311369
- HPSBOV02763 vendor-advisory
- http://support.apple.com/kb/HT5130
- 49241 vdb-entry
- MDVSA-2011:165 vendor-advisory
- [oss-security] 20110524 Re: CVE request: PHP socket_connect() - stack buffer overflow mailing-list
- DSA-2399 vendor-advisory
- http://svn.php.net/viewvc/php/php-src/trunk/ext/sockets/sockets.c?r1=311369&r2=311368&pathrev=311369
- APPLE-SA-2012-02-01-1 vendor-advisory
- 72644 vdb-entry
- 8294 third-party-advisory
- 17318 exploit
- RHSA-2011:1423 vendor-advisory
- http://www.php.net/ChangeLog-5.php#5.3.7
- 8262 third-party-advisory
- http://www.php.net/archive/2011.php#id2011-08-18-1
- [oss-security] 20110523 CVE request: PHP socket_connect() - stack buffer overflow mailing-list
- php-socketconnect-bo(67606) vdb-entry