OSVDB ID: 12411

Title: PHP unpack() Function Heap Information Leak

Info

Disclosure
Dec 15, 2004

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 PHP contains a flaw that may allow a remote attacker to read arbitrary portions of system memory. The issue is due to the unpack() function not properly validating parameters passed to it.

Classification

 Location: Location Unknown
Attack Type: Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Unknown
Disclosure: OSVDB Verified, Vendor Verified

Solution

 Upgrade to version 4.3.10 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

The PHP Group

PHP

 5.0.0 Beta 1
5.0.0 Beta 2
5.0.0 Beta 3
5.0.0 Beta 4
5.0.0 Release Candidate 1
5.0.0 Release Candidate 2
5.0.0 Release Candidate 3
5.0.0
5.0.1
5.0.2
4.0.x
4.1.x
4.2.x
4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/12411