PHP is prone to multiple format-string vulnerabilities due to a design error when casting 64-bit variables to 32 bits. Attackers may be able to exploit these issues to execute arbitrary code in the context of the webserver process or to cause denial-of- service conditions. These issues affect PHP versions prior to 4.4.5 and 5.2.1 running on 64-bit computers.

The vendor released versions 5.2.1 and 4.4.5 to address these issues. Please see the references for more information.

• http://www.php-security.org/MOPB/MOPB-38-2007.html
• http://www.php.net
• http://www.php.net/releases/4_4_5.php
• http://www.php.net/releases/5_2_1.php
• http://www.securityfocus.com/bid/23219
• http://www8.itrc.hp.com/service/cki/docDisplay.do?docId=c01056506

---

Updated on 2015-03-25