Total vulnerabilities in the database
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.
| Software | From | Fixed in |
|---|---|---|
| php / php | 5.4.12-rc1 | 5.4.12-rc1.x |
| php / php | 5.4.12 | 5.4.12.x |
| php / php | 5.4.14 | 5.4.14.x |
| php / php | 5.4.8 | 5.4.8.x |
| php / php | 5.4.14-rc1 | 5.4.14-rc1.x |
| php / php | 5.4.12-rc2 | 5.4.12-rc2.x |
| php / php | 5.4.9 | 5.4.9.x |
| php / php | 5.4.11 | 5.4.11.x |
| php / php | 5.4.10 | 5.4.10.x |
| php / php | 5.4.2 | 5.4.2.x |
| php / php | 5.4.5 | 5.4.5.x |
| php / php | 5.4.6 | 5.4.6.x |
| php / php | 5.4.13 | 5.4.13.x |
| php / php | 5.4.0 | 5.4.0.x |
| php / php | 5.4.3 | 5.4.3.x |
| php / php | 5.4.1 | 5.4.1.x |
| php / php | 5.4.13-rc1 | 5.4.13-rc1.x |
| php / php | 5.4.7 | 5.4.7.x |
| php / php | - | 5.4.15.x |
| php / php | 5.4.4 | 5.4.4.x |
| php / php | 5.5.0-alpha1 | 5.5.0-alpha1.x |
| php / php | 5.5.0-alpha3 | 5.5.0-alpha3.x |
| php / php | 5.5.0-beta3 | 5.5.0-beta3.x |
| php / php | 5.5.0-beta1 | 5.5.0-beta1.x |
| php / php | - | 5.5.0.x |
| php / php | 5.5.0-beta4 | 5.5.0-beta4.x |
| php / php | 5.5.0-alpha6 | 5.5.0-alpha6.x |
| php / php | 5.5.0-beta2 | 5.5.0-beta2.x |
| php / php | 5.5.0-alpha4 | 5.5.0-alpha4.x |
| php / php | 5.5.0-alpha5 | 5.5.0-alpha5.x |
| php / php | 5.5.0-alpha2 | 5.5.0-alpha2.x |