PHP 'php_binary' serialization handler is prone to a heap- information leak. The vulnerability arises because of a missing boundary check in the extraction of variable names. A local attacker can exploit this issue to obtain sensitive information (such as heap offsets and canaries) that may aid in other attacks. These versions are affected: PHP4 versions prior to 4.4.5 PHP5 versions prior to 5.2.1 Updates are available.

This issue was previously disclosed to the PHP development team. It has been fixed in the latest releases.

• http://www.php.net
• http://www.securityfocus.com/bid/22805
• http://www8.itrc.hp.com/service/cki/docDisplay.do?docId=c01056506

---

Updated on 2017-03-28