Vulnerability in PHP
CVE-2006-3017
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.041 (90.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 90.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.041 · newest: 0.041 · change: 0.000
Affected products
- PHP — versions 3.0, 3.0.1, 3.0.2
References
- secunia.com/advisories/21723 (Vendor Advisory, third-party-advisory)
- issues.rpath.com/browse/RPL-683
- secunia.com/advisories/21252 (Vendor Advisory, third-party-advisory)
- secunia.com/advisories/21202 (Vendor Advisory, third-party-advisory)
- cvs.php.net/viewcvs.cgi/Zend/zend_hash.c
- www.turbolinux.com/security/2006/TLSA-2006-38.txt (vendor-advisory)
- cvs.php.net/viewcvs.cgi/Zend/zend_hash.c
- www.debian.org/security/2006/dsa-1206 (vendor-advisory)
- secunia.com/advisories/21050 (Vendor Advisory, third-party-advisory)
- www.novell.com/linux/security/advisories/2006_31_php.html (vendor-advisory)