National Cyber Awareness System

Vulnerability Summary for CVE-2006-1990

Overview

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.

Impact

CVSS Severity (version 2.0 upgrade from v1.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-333A

Name: TA06-333A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-333A.html

External Source: VUPEN

Name: ADV-2006-4750

Hyperlink:http://www.vupen.com/english/advisories/2006/4750

External Source: VUPEN

Name: ADV-2006-1500

Hyperlink:http://www.vupen.com/english/advisories/2006/1500

External Source: MANDRIVA

Name: MDKSA-2006:091

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:091

External Source: MISC

Name: http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02

Hyperlink:http://www.infigo.hr/en/in_focus/advisories/INFIGO-2006-04-02

External Source: OVAL

Name: oval:org.mitre.oval:def:9696

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9696

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-683

Hyperlink:https://issues.rpath.com/browse/RPL-683

External Source: XF

Name: php-wordwrap-string-bo(26001)

Hyperlink:http://xforce.iss.net/xforce/xfdb/26001

External Source: UBUNTU

Name: USN-320-1

Hyperlink:http://www.ubuntu.com/usn/usn-320-1

External Source: TURBO

Name: TLSA-2006-38

Hyperlink:http://www.turbolinux.com/security/2006/TLSA-2006-38.txt

External Source: BUGTRAQ

Name: 20061005 rPSA-2006-0182-1 php php-mysql php-pgsql

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/447866/100/0/threaded

External Source: REDHAT

Name: RHSA-2006:0568

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0568.html

External Source: REDHAT

Name: RHSA-2006:0501

Hyperlink:http://www.redhat.com/support/errata/RHSA-2006-0501.html

External Source: SUSE

Name: SUSE-SA:2006:031

Hyperlink:http://www.novell.com/linux/security/advisories/2006_31_php.html

External Source: MANDRIVA

Name: MDKSA-2006:122

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:122

External Source: MANDRAKE

Name: MDKSA-2006:091

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2006:091

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-175.htm

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm

External Source: SECTRACK

Name: 1015979

Hyperlink:http://securitytracker.com/id?1015979

External Source: GENTOO

Name: GLSA-200605-08

Hyperlink:http://security.gentoo.org/glsa/glsa-200605-08.xml

External Source: SECUNIA

Name: 23155

Hyperlink:http://secunia.com/advisories/23155

External Source: SECUNIA

Name: 22225

Hyperlink:http://secunia.com/advisories/22225

External Source: SECUNIA

Name: 21723

Hyperlink:http://secunia.com/advisories/21723

External Source: SECUNIA

Name: 21564

Hyperlink:http://secunia.com/advisories/21564

External Source: SECUNIA

Name: 21252

Hyperlink:http://secunia.com/advisories/21252

External Source: SECUNIA

Name: 21135

Hyperlink:http://secunia.com/advisories/21135

External Source: SECUNIA

Name: 21125

Hyperlink:http://secunia.com/advisories/21125

External Source: SECUNIA

Name: 21050

Hyperlink:http://secunia.com/advisories/21050

External Source: SECUNIA

Name: 21031

Hyperlink:http://secunia.com/advisories/21031

External Source: SECUNIA

Name: 20676

Hyperlink:http://secunia.com/advisories/20676

External Source: SECUNIA

Name: 20269

Hyperlink:http://secunia.com/advisories/20269

External Source: SECUNIA

Name: 20222

Hyperlink:http://secunia.com/advisories/20222

External Source: SECUNIA

Name: 20052

Hyperlink:http://secunia.com/advisories/20052

External Source: SECUNIA

Name: 19803

Hyperlink:http://secunia.com/advisories/19803

External Source: REDHAT

Name: RHSA-2006:0549

Hyperlink:http://rhn.redhat.com/errata/RHSA-2006-0549.html

External Source: APPLE

Name: APPLE-SA-2006-11-28

Hyperlink:http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=304829

Hyperlink:http://docs.info.apple.com/article.html?artnum=304829

External Source: SGI

Name: 20060701-01-U

Hyperlink:ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U

References to Check Content

Identifier:oval:org.mitre.oval:def:9696

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9696