CVE-2006-4812

Exp

Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).

Published: 2006-10-10 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2006-4812 is rated High Exploit Risk (85.4/100): CVSS Critical severity, with high exploitation likelihood (EPSS 39.41%, 97th percentile). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2006-4812

EDB-ID Source Kind Published Link
28760 exploit_db edb 2006-10-05 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2006-4812

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2025-12-28 43.00% 39.41% -3.58%
2 2025-12-27 39.41% 43.00% +3.58%
3 2025-11-04 — 39.41% —

Full EPSS history (19 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2006-4812

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
10.0 2.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 10.0 10.0 [email protected]

Weakness enumeration for CVE-2006-4812

OS Trackers for CVE-2006-4812

vendor priority summary link
alpine — CVE-2006-4812: no source package rows; 0 state rows across 0 repos (none); fixed 0, open 0. https://security.alpinelinux.org/vuln/CVE-2006-4812
gentoo high CVE-2006-4812: 1 GLSA(s) (200610-14), 1 atom(s) (dev-lang/php); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2006-4812
redhat high — https://access.redhat.com/security/cve/CVE-2006-4812
ubuntu medium CVE-2006-4812 medium priority: Ubuntu including 2 source packages (php4, php5), 8 status rows across 4 suites (dapper, edgy, feisty, upstream): released 3, needs-triage 2, not-affected 2, DNE 1. https://ubuntu.com/security/CVE-2006-4812

Vendor comments (NVD) for CVE-2006-4812

  • Red Hat (2008-06-26T00:00:00)

    Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. This issue did not affect the versions of php as shipped with Red Hat Enterprise Linux 3, and 4.

Affected software / configurations for CVE-2006-4812

Vendor Product Version Raw CPE
php php 4.0 cpe:2.3:a:php:php:4.0:*:*:*:*:*:*:*
php php 4.0.1 cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
php php 4.0.1 cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
php php 4.0.1 cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
php php 4.0.2 cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
php php 4.0.3 cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
php php 4.0.3 cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
php php 4.0.4 cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
php php 4.0.5 cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
php php 4.0.6 cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
php php 4.0.7 cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
php php 4.0.7 cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
php php 4.0.7 cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
php php 4.0.7 cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
php php 4.1.0 cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
php php 4.1.1 cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
php php 4.1.2 cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
php php 4.2 cpe:2.3:a:php:php:4.2:*:dev:*:*:*:*:*
php php 4.2.0 cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
php php 4.2.1 cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
php php 4.2.2 cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
php php 4.2.3 cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
php php 5.0 cpe:2.3:a:php:php:5.0:rc1:*:*:*:*:*:*
php php 5.0 cpe:2.3:a:php:php:5.0:rc2:*:*:*:*:*:*
php php 5.0 cpe:2.3:a:php:php:5.0:rc3:*:*:*:*:*:*
php php 5.0.0 cpe:2.3:a:php:php:5.0.0:*:*:*:*:*:*:*
php php 5.0.1 cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
php php 5.0.2 cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
php php 5.0.3 cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
php php 5.0.4 cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
php php 5.0.5 cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
php php 5.1.0 cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
php php 5.1.1 cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
php php 5.1.2 cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
php php 5.1.3 cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
php php 5.1.4 cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
php php 5.1.5 cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
php php 5.1.6 cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*

References for CVE-2006-4812

URL Tags
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_alloc.c?r1=1.161&r2=1.162
http://lists.suse.com/archive/suse-security-announce/2006-Oct/0002.html
http://rhn.redhat.com/errata/RHSA-2006-0688.html
http://rhn.redhat.com/errata/RHSA-2006-0708.html Patch Vendor Advisory
http://secunia.com/advisories/22280 Patch Vendor Advisory
http://secunia.com/advisories/22281
http://secunia.com/advisories/22300
http://secunia.com/advisories/22331
http://secunia.com/advisories/22338
http://secunia.com/advisories/22533
http://secunia.com/advisories/22538
http://secunia.com/advisories/22650
http://securityreason.com/securityalert/1691
http://securitytracker.com/id?1016984 Patch
http://support.avaya.com/elmodocs2/security/ASA-2006-223.htm
http://support.avaya.com/elmodocs2/security/ASA-2006-234.htm
http://www.gentoo.org/security/en/glsa/glsa-200610-14.xml
http://www.hardened-php.net/advisory_092006.133.html Vendor Advisory
http://www.hardened-php.net/files/CVE-2006-4812.patch Patch
http://www.securityfocus.com/archive/1/448014/100/0/threaded
http://www.securityfocus.com/archive/1/448953/100/0/threaded
http://www.securityfocus.com/bid/20349
http://www.trustix.org/errata/2006/0055
http://www.ubuntu.com/usn/usn-362-1
http://www.vupen.com/english/advisories/2006/3922
https://exchange.xforce.ibmcloud.com/vulnerabilities/29362
cvelogic Threat Intelligence