Description
The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | php5 | 5.3.3-7+squeeze7 | DSA-2403-1 |
| Debian 5.0 | php5 | 5.2.6.dfsg.1-1+lenny16 | DSA-2403-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | php +25 | 5.3.3-3.el6_2.6 | RHSA-2012:0093 |
| RHEL 5 | php +18 | 5.1.6-27.el5_7.5 | RHSA-2012:0093 |
| RHEL 5 | php53 +20 | 5.3.3-1.el5_7.6 | RHSA-2012:0092 |
| RHEL 4 | php +13 | 4.3.9-3.36 | RHSA-2012:0093 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | php5 | 5.6.28-1.1 | openSUSE-SU-2024:10344-1 |
| openSUSE Tumbleweed | php7 | 7.0.14-1.4 | openSUSE-SU-2024:10290-1 |
| openSUSE Tumbleweed | php8 | 8.0.11-1.1 | openSUSE-SU-2024:11169-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 5.4.0RC6 (x64) - Denial of Service EDB-18460 · dos · Feb 4, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2012:0093 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0092 Red Hat Security Advisory: php53 security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2403-1 php5 - code injection Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10290-1 apache2-mod_php7-7.0.14-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10344-1 apache2-mod_php5-5.6.28-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11169-1 php8-8.0.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SSRT100856 vendor-advisory
- http://svn.php.net/viewvc?view=revision&revision=323007
- HPSBMU02786 vendor-advisory
- http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/
- 51830 vdb-entry
- RHSA-2012:0092 vendor-advisory
- SUSE-SU-2012:0411 vendor-advisory
- 78819 vdb-entry
- 47806 third-party-advisory
- openSUSE-SU-2012:0426 vendor-advisory
- DSA-2403 vendor-advisory
- php-phpregistervariableex-code-exec(72911) vdb-entry
- 48668 third-party-advisory
- http://www.php.net/ChangeLog-5.php#5.3.10
- 47801 third-party-advisory
- [oss-security] 20120202 PHP remote code execution introduced via HashDoS fix mailing-list
- [oss-security] 20120203 Re: PHP remote code execution introduced via HashDoS fix mailing-list
- 1026631 vdb-entry
- http://www.h-online.com/security/news/item/Critical-PHP-vulnerability-being-fixed-1427316.html
- http://support.apple.com/kb/HT5281
- https://gist.github.com/1725489
- APPLE-SA-2012-05-09-1 vendor-advisory
- 47813 third-party-advisory