CVE-2006-4482
published 2006-08-31CVE-2006-4482: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit…
PriorityP429critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.49%
90.4th percentile
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| php | php | < 5.1.5 | 5.1.5 |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat5.0MEDIUM
vendor_ubuntu4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2006-09-07·CVSS 4.6
CVE-2006-4020 [MEDIUM] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP vulnerabilities
The sscanf() function did not properly check array boundaries. In
applications which use sscanf() with argument swapping, a remote attacker
could potentially exploit this to crash the affected web application
or even execute arbitrary code with the application's privileges.
(CVE-2006-4020)
The file_exists() and imap_reopen() functions did not perform
proper open_basedir and safe_mode checks which could allow local
scripts to bypass intended restrictions. (CVE-2006-4481)
On 64 bit systems the str_repeat() and wordwrap() functions did not
properly check buffer boundaries. Depending on the application, this
could potentially be exploited to execute arbitrary code with the
applications' privileges. This only affects the amd64 and spar
Red Hat
security flaw
vendor_redhat·2006-08-17·CVSS 5.0
CVE-2006-4482 [MEDIUM] security flaw
security flaw
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
GHSA
GHSA-jxvq-9v75-wqch: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string
ghsa_unreviewed·2022-05-03·CVSS 5.0
CVE-2006-4482 [MEDIUM] CWE-119 GHSA-jxvq-9v75-wqch: Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-4482 security flaw
bugzilla·2018-08-16·CVSS 5.0
CVE-2006-4482 [MEDIUM] CVE-2006-4482 security flaw
CVE-2006-4482 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
Bugzilla
CVE-2006-4020 PHP security issues (CVE-2006-4482 CVE-2006-4484 CVE-2006-4485 CVE-2006-4486)
bugzilla·2006-09-19·CVSS 4.6
CVE-2006-4020 [MEDIUM] CVE-2006-4020 PHP security issues (CVE-2006-4482 CVE-2006-4484 CVE-2006-4485 CVE-2006-4486)
CVE-2006-4020 PHP security issues (CVE-2006-4482 CVE-2006-4484 CVE-2006-4485 CVE-2006-4486)
Description of problem:
The following issues affect the PHP package:
CVE-2006-4486 PHP integer overflows in Zend
CVE-2006-4485 PHP buffer overread in str_ipos
CVE-2006-4482 PHP heap overflow in wordwrap/str_repeat
CVE-2006-4020 PHP sscanf buffer overflow
CVE-2006-4484 PHP heap overflow in LWZReadByte
Version-Release number of selected component (if applicable):
php-5.1.4-1.el4s1.2
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solutio
Bugzilla
CVE-2006-4482 PHP heap overflow
bugzilla·2006-09-18·CVSS 5.0
CVE-2006-4482 [MEDIUM] CVE-2006-4482 PHP heap overflow
CVE-2006-4482 PHP heap overflow
+++ This bug was initially created as a clone of Bug #204993 +++
(Description from MITRE)
Multiple heap-based buffer overflows in the (1) str_repeat and (2)
wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when
used on a 64-bit system, have unspecified impact and attack vectors, a
different vulnerability than CVE-2006-1990.
This is the result of using int = size_t * sizt_t where int is 32 bits
and size_t is 64 bits. The odds of exploiting this remotely are slim
as you would probably have to send 2 gigs of data to a broken app.
http://www.php.net/release_5_1_5.php
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11
Discussion:
An advisory has been issued which should help the problem
describe
ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.aschttp://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11http://rhn.redhat.com/errata/RHSA-2006-0688.htmlhttp://secunia.com/advisories/21546http://secunia.com/advisories/21768http://secunia.com/advisories/22004http://secunia.com/advisories/22039http://secunia.com/advisories/22069http://secunia.com/advisories/22225http://secunia.com/advisories/22440http://secunia.com/advisories/22487http://secunia.com/advisories/22538http://secunia.com/advisories/22713http://securitytracker.com/id?1016984http://support.avaya.com/elmodocs2/security/ASA-2006-221.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-222.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-223.htmhttp://www.debian.org/security/2006/dsa-1206http://www.novell.com/linux/security/advisories/2006_52_php.htmlhttp://www.php.net/ChangeLog-5.php#5.1.5http://www.php.net/release_5_1_5.phphttp://www.redhat.com/support/errata/RHSA-2006-0669.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0682.htmlhttp://www.securityfocus.com/archive/1/447866/100/0/threadedhttp://www.securityfocus.com/bid/19582http://www.turbolinux.com/security/2006/TLSA-2006-38.txthttp://www.ubuntu.com/usn/usn-342-1http://www.vupen.com/english/advisories/2006/3318https://issues.rpath.com/browse/RPL-683https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10121ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.aschttp://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.10&r2=1.445.2.14.2.11http://rhn.redhat.com/errata/RHSA-2006-0688.htmlhttp://secunia.com/advisories/21546http://secunia.com/advisories/21768http://secunia.com/advisories/22004http://secunia.com/advisories/22039http://secunia.com/advisories/22069http://secunia.com/advisories/22225http://secunia.com/advisories/22440http://secunia.com/advisories/22487http://secunia.com/advisories/22538http://secunia.com/advisories/22713http://securitytracker.com/id?1016984http://support.avaya.com/elmodocs2/security/ASA-2006-221.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-222.htmhttp://support.avaya.com/elmodocs2/security/ASA-2006-223.htmhttp://www.debian.org/security/2006/dsa-1206http://www.novell.com/linux/security/advisories/2006_52_php.htmlhttp://www.php.net/ChangeLog-5.php#5.1.5http://www.php.net/release_5_1_5.phphttp://www.redhat.com/support/errata/RHSA-2006-0669.htmlhttp://www.redhat.com/support/errata/RHSA-2006-0682.htmlhttp://www.securityfocus.com/archive/1/447866/100/0/threadedhttp://www.securityfocus.com/bid/19582http://www.turbolinux.com/security/2006/TLSA-2006-38.txthttp://www.ubuntu.com/usn/usn-342-1http://www.vupen.com/english/advisories/2006/3318https://issues.rpath.com/browse/RPL-683https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10121
2006-08-31
Published