CVE-2008-3659 Memory corruption in n/a
Buffer overflow in PHP's explode function allows attackers to cause crashes or execute arbitrary code via a crafted delimiter argument.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-3659?
CVE-2008-3659 is a medium-severity memory corruption vulnerability in Php Php, published on 15 Aug 2008. It can be exploited over the network, with no action from the victim.
Official description
Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.
Weakness: CWE-119
Which versions are affected by CVE-2008-3659?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2008-3659?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2008-3659 being exploited?
There is no known exploitation of CVE-2008-3659 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-q9wh-phxj-rxf5.