CVE-2006-1990

Publication date 24 April 2006

Last updated 17 July 2025

Ubuntu priority

Medium

Why this priority?

Description

Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function call, a different vulnerability than CVE-2002-1396.

Status

Package Ubuntu Release Status
php4 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty Not in release
6.10 edgy
Fixed in 4.4.2-1.1
6.06 LTS dapper Ignored end of life
php5 9.10 karmic
Fixed in 5.2.3-1ubuntu5
9.04 jaunty
Fixed in 5.2.3-1ubuntu5
8.10 intrepid
Fixed in 5.2.3-1ubuntu5
8.04 LTS hardy
Fixed in 5.2.3-1ubuntu5
7.10 gutsy
Fixed in 5.2.3-1ubuntu5
7.04 feisty
Fixed in 5.2.1-0ubuntu1.4
6.10 edgy
Fixed in 5.1.6-1ubuntu2.6
6.06 LTS dapper
Fixed in 5.1.2-1ubuntu3.9

References

Related Ubuntu Security Notices (USN)

Other references

Access our resources on patching vulnerabilities