A weakness and a vulnerability have been reported in PHP, which can be exploited by malicious people to conduct brute force attacks, cause a DoS (Denial of Service), and potentially compromise a vulnerable system.

1) The vulnerability is caused due to an integer overflow error within the phar extension in the "phar_parse_tarfile()" function (ext/phar/tar.c) and can be exploited to cause a heap-based buffer overflow via a specially crafted TAR file.

Successful exploitation of this vulnerability may allow execution of arbitrary code.

2) The weakness is caused due to an error in the DES implementation within the "crypt()" function.

For more information:
SA49304

The weakness and the vulnerability are reported in versions prior to 5.3.14 and 5.4.4.

Solution
Update to version 5.4.4 or 5.3.14.

Provided and/or discovered by
1) Alexander Gavrun

Changelog
Further details available to Secunia VIM customers

Original Advisory
Alexander Gavrun:
http://0x1byte.blogspot.com/2011/04/php-phar-extension-heap-overflow.html

PHP:
http://www.php.net/archive/2012.php#id2012-06-14-1

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers