Total vulnerabilities in the database
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
| Software | From | Fixed in |
|---|---|---|
| php / php | 4.0-beta1 | 4.0-beta1.x |
| php / php | 4.0-beta4 | 4.0-beta4.x |
| php / php | 4.0-rc1 | 4.0-rc1.x |
| php / php | 4.0 | 4.0.x |
| php / php | 4.0-beta2 | 4.0-beta2.x |
| php / php | 4.0-rc2 | 4.0-rc2.x |
| php / php | 4.0-beta_4_patch1 | 4.0-beta_4_patch1.x |
| php / php | 4.0-beta3 | 4.0-beta3.x |
| php / php | 4.0.0 | 4.4.5 |
| php / php | 5.0.0 | 5.2.1 |
| canonical / ubuntu_linux | 6.06 | 6.06.x |
| canonical / ubuntu_linux | 6.10 | 6.10.x |
| canonical / ubuntu_linux | 5.10 | 5.10.x |