CVE-2011-1938

Publication date 31 May 2011

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.

Read the notes from the security team

Status

Package Ubuntu Release Status

Notes

jdstrand

PoC in http://www.exploit-db.com/exploits/17318/ stack-protector should reduce to DoS, downgrading to low

mdeslaur

says 5.3.3, but reproducer works on lucid also another PoC: http://www.exploit-db.com/exploits/17486/

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details

References

Related Ubuntu Security Notices (USN)

Other references