PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with _SESSION|s:39:.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Php | Php | 4.0.0 (including) | 4.4.5 (excluding) |
| Php | Php | 5.0.0 (including) | 5.2.1 (excluding) |
| Red Hat Enterprise Linux 2.1 | RedHat | php-0:4.1.2-2.14 | * |
| Red Hat Enterprise Linux 3 | RedHat | php-0:4.3.2-39.ent | * |
| Red Hat Enterprise Linux 4 | RedHat | php-0:4.3.9-3.22.3 | * |
| Red Hat Enterprise Linux 5 | RedHat | php-0:5.1.6-7.el5 | * |
| Red Hat Web Application Stack for RHEL 4 | RedHat | php-0:5.1.6-3.el4s1.5 | * |
| Stronghold 4.0 for RHEL 2.1AS | RedHat | stronghold-php-0:4.1.2-12 | * |