Stefan Esser has reported some vulnerabilities in PHP, which can be exploited by malicious users to compromise a vulnerable system.

1) A double free error within the "session_regenerate_id()" function can be exploited to execute arbitrary code with the privileges of the PHP interpreter.

2) A double free error within the handling of rejected sessions in PHP's internal storage module can be exploited to execute arbitrary code with the privileges of the PHP interpreter.

Successful exploitation requires that a user can e.g. upload and execute malicious PHP scripts. Remote exploitation may be possible, but has not currently been proven.

The vulnerabilities are reported in version 5.2.0 and 5.2.1, vulnerability #1 potentially also affects version 4.x. Other versions may also be affected.

Solution
Update to version 5.2.2 or 4.4.7 to fix vulnerability #1. Allow only trusted users to upload and execute PHP scripts.

Provided and/or discovered by
Stefan Esser

Changelog
Further details available in Customer Area

Original Advisory
PHP:
http://www.php.net/releases/5_2_2.php
http://www.php.net/releases/4_4_7.php

MOPB:
http://www.php-security.org/MOPB/MOPB-22-2007.html
http://www.php-security.org/MOPB/MOPB-23-2007.html

Deep Links
Links available in Customer Area