PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer-overflow and corrupt process memory. Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition. This issue affects versions prior to PHP 4.4.5 and 5.2.1.

The vendor released PHP 4.4.5 and 5.2.1 to address this issue. Please see the references for more information.

• http://www.php-security.org/MOPB/MOPB-39-2007.html
• http://www.php.net/
• http://www.php.net/releases/4_4_5.php
• http://www.php.net/releases/5_2_1.php
• http://www.securityfocus.com/bid/23233
• http://www8.itrc.hp.com/service/cki/docDisplay.do?docId=c01056506

---

Updated on 2015-03-25