CVEvulnerability

CVE-2008-3659

6.4 MEDIUM Published 2008-08-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-08-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
CWE-119

Description

Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.

Affected configurations

• php php 4.4.0 • php php 4.4.1 • php php 4.4.2 • php php 4.4.3 • php php 4.4.4 • php php 4.4.5 • php php 4.4.6 • php php 4.4.7 • php php 4.4.8 • php php 5.2.0 • php php 5.2.1 • php php 5.2.2 • php php 5.2.3 • php php 5.2.4 • php php 5.2.5 • php php 5.2.6

Related

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References