The WDDX deserializer in the wddx extension in PHP 5 prior to 5.2.1 and PHP 4 prior to 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent malicious users to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
php php 4.0 |
||
php php |
||
canonical ubuntu linux 5.10 |
||
canonical ubuntu linux 6.06 |
||
canonical ubuntu linux 6.10 |