CVE-2006-3017
HIGH
9.3
CVSS 2.0
Description
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
Affected products and versions
- PHP — Up to and including 4.4.2
- PHP versions 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 4.0, 4.0.0, 4.0.1, 4.0.1patch1, 4.0.1patch2, 4.0.2, 4.0.3, 4.0.3patch1, 4.0.4, 4.0.4patch1, 4.0.5, 4.0.6, 4.0.7, 4.0.7rc1, 4.0.7rc2, 4.0.7rc3, 4.0beta1, 4.0beta2, 4.0beta3, 4.0beta4, 4.0beta_4_patch1, 4.0rc1, 4.0rc2, 4.1.0, 4.1.1, 4.1.2, 4.2, 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.4.0, 4.4.1, 5.0.0, 5.0.0beta1, 5.0.0beta2, 5.0.0beta3, 5.0.0beta4, 5.0.0rc1, 5.0.0rc2, 5.0.0rc3, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0rc1, 5.0rc2, 5.0rc3, 5.1.0, 5.1.1, 5.1.2, pl1
References
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0166.html
- cvs.php.net http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&r1=1.87.4.8.2.1&r2=1.87.4.8.2.2
- cvs.php.net http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&view=log
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2006-0549.html
- secunia.com http://secunia.com/advisories/19927 Vendor Advisory
- secunia.com http://secunia.com/advisories/21031 Vendor Advisory
- secunia.com http://secunia.com/advisories/21050 Vendor Advisory
- secunia.com http://secunia.com/advisories/21125 Vendor Advisory
- secunia.com http://secunia.com/advisories/21135 Vendor Advisory
- secunia.com http://secunia.com/advisories/21202 Vendor Advisory
- secunia.com http://secunia.com/advisories/21252 Vendor Advisory
- secunia.com http://secunia.com/advisories/21723 Vendor Advisory
- secunia.com http://secunia.com/advisories/22225 Vendor Advisory
- secunia.com http://secunia.com/advisories/22713 Vendor Advisory
- securitytracker.com http://securitytracker.com/id?1016306
- securitytracker.com http://securitytracker.com/id?1016649
- support.avaya.com http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm
- www.debian.org http://www.debian.org/security/2006/dsa-1206
- www.hardened-php.net http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html
- www.mandriva.com http://www.mandriva.com/security/advisories?name=MDKSA-2006:122
- www.novell.com http://www.novell.com/linux/security/advisories/2006_31_php.html
- www.novell.com http://www.novell.com/linux/security/advisories/2006_34_php4.html
- www.osvdb.org http://www.osvdb.org/25255
- www.osvdb.org http://www.osvdb.org/26466
- www.php.net http://www.php.net/release_5_1_3.php
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2006-0567.html
- www.redhat.com http://www.redhat.com/support/errata/RHSA-2006-0568.html
- www.securityfocus.com http://www.securityfocus.com/archive/1/442437/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/archive/1/447866/100/0/threaded
- www.securityfocus.com http://www.securityfocus.com/bid/17843
- www.turbolinux.com http://www.turbolinux.com/security/2006/TLSA-2006-38.txt
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/27396
- issues.rpath.com https://issues.rpath.com/browse/RPL-683
- oval.cisecurity.org https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10118
- usn.ubuntu.com https://usn.ubuntu.com/320-1/
- nvd.nist.gov Official NVD record