Description

zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.

Remediation

References

CVE-2006-3017

Related Vulnerabilities

PHP Improper Input Validation Vulnerability (CVE-2007-4784)

WordPress Plugin GiveWP-Donation and Fundraising Platform Cross-Site Scripting (0.8)

PHP-Fusion Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-6850)

IBM RTC Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-1423)

WordPress Plugin Vertical SlideShow Arbitrary File Upload (2.3)

Severity

Critical

Classification

CVE-2006-3017

Tags

Missing Update Known Vulnerabilities