CVE-2006-1990

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.

🔗 References (74)

• secalert@redhatftp://patches.sgi.com/support/free/security/advisories/20060701-01-U
• secalert@redhathttp://docs.info.apple.com/article.html?artnum=304829
• secalert@redhathttp://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html
• secalert@redhathttp://rhn.redhat.com/errata/RHSA-2006-0549.html
• secalert@redhathttp://secunia.com/advisories/19803
• secalert@redhathttp://secunia.com/advisories/20052
• secalert@redhathttp://secunia.com/advisories/20222
• secalert@redhathttp://secunia.com/advisories/20269
• secalert@redhathttp://secunia.com/advisories/20676
• secalert@redhathttp://secunia.com/advisories/21031
• secalert@redhathttp://secunia.com/advisories/21050
• secalert@redhathttp://secunia.com/advisories/21125
• secalert@redhathttp://secunia.com/advisories/21135
• secalert@redhathttp://secunia.com/advisories/21252
• secalert@redhathttp://secunia.com/advisories/21564