VA-26-295-01

PHP insecure error handling and state management

PHP insecurely handles multiple combinations of memory allocations and error conditions. These behaviors can allow a remote attacker to cause a denial of service or execute arbitrary code. Successful exploitation depends on a number of factors including the specific PHP application being targeted, the SAPI and web server, error handling and memory resource configuration, and platform or OS-level memory protections. Without significant analysis effort to prove otherwise, any application running on a vulnerable version of PHP should be considered vulnerable and exploitable.