Vulnerability in php5 - Stack-based Buffer Overflow
Summary
DLA-1066-1: php5 - security update. Affects php5 versions < 5.4.45-0+deb7u10. Fixed in 5.4.45-0+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The php5 package is a widely used open-source scripting language primarily designed for web development. It provides a powerful and flexible platform for creating dynamic web pages and applications. This vulnerability specifically affects the zend_ini_do_op() function in the Zend/zend_ini_parser.c file. The function is responsible for parsing and processing php.ini directives. If a PHP application accepts untrusted input for the parse_ini_string or parse_ini_file function, it may be vulnerable to a stack-based buffer overflow. This could lead to a denial of service or potentially allow an attacker to execute arbitrary code.
Vulnerability Detail
The stack-based buffer overflow vulnerability in the zend_ini_do_op() function of php5 can be exploited by providing malicious input to the parse_ini_string or parse_ini_file function. This can result in a denial of service or enable an attacker to execute arbitrary code on the affected system. It is important to note that this vulnerability only affects PHP applications that accept untrusted input for parsing php.ini directives.
How To Fix
Minimum fixed version
5.4.45-0+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the php5 package is vulnerable to a stack-based buffer overflow in the zend_ini_do_op() function. This can be exploited by providing malicious input to the parse_ini_string or parse_ini_file function. To mitigate this vulnerability, it is recommended to upgrade to php5 version 5.4.45-0+deb7u10 or later. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for php5 →
FAQ
The vulnerability affects all versions of php5 prior to version 5.4.45-0+deb7u10 on Debian 7 Wheezy.
The vulnerability can lead to a denial of service or allow an attacker to execute arbitrary code on systems running vulnerable versions of php5.
Yes, this vulnerability can be exploited remotely if the affected PHP application is accessible over the network.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
For more information about this vulnerability, you can refer to the Debian LTS security advisory DLA-1066-1.
Related vulnerabilities
Recent vulnerabilities recorded for php5.
