Mapserver 5.2, 5.4 and 5.6 prior to 5.6.5-2 improperly validates symbol index values during Mapfile parsing.
osgeo mapserver 5.2.0
osgeo mapserver 5.4.0
osgeo mapserver