Some vulnerabilities have been reported in PHP, where some have unknown impacts and another can be exploited by malicious people to bypass certain security restrictions, or conduct cross-site scripting and HTTP response smuggling attacks.

1) An offset/length parameter validation error exists in the "substr_compare()" function.

2) An error exists in the handling of certain characters in session names, which can be exploited to conduct cross-site scripting or HTTP response splitting attacks.

3) An error in the "zend_hash_del_key_or_index()" function when deleting elements can e.g. be exploited to cause the "unset()" function to not unset variables properly.

For more information:
SA19927

Many other issues, where some may be security related, have also been reported.

Solution
Update to version 4.4.3.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
PHP Group:
http://www.php.net/release_4_4_3.php

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area