CVE-2011-1938

Publication date 31 May 2011

Last updated 24 July 2024

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
php5	11.10 oneiric	Not affected
	11.04 natty	Fixed 5.3.5-1ubuntu7.3
	10.10 maverick	Fixed 5.3.3-1ubuntu9.6
	10.04 LTS lucid	Fixed 5.3.2-1ubuntu4.10
	8.04 LTS hardy	Not affected

Notes

jdstrand

PoC in http://www.exploit-db.com/exploits/17318/ stack-protector should reduce to DoS, downgrading to low

mdeslaur

says 5.3.3, but reproducer works on lucid also another PoC: http://www.exploit-db.com/exploits/17486/

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
php5	Upstream: http://svn.php.net/viewvc?view=revision&revision=311369 Upstream: http://svn.php.net/viewvc?view=revision&revision=311370 Debdiff: https://launchpad.net/bugs/813110

CVE-2011-1938

Status

Notes

jdstrand

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references