PHP contains a flaw that may allow a remote attacker to execute arbitrary code. The issue is due to insufficient validation of parameters passed to the pack() function which may result in a heap overflow. It is possible that the flaw may allow a remote attacker to bypass safe_mode restrictions and execute arbitrary code with the privileges of the Web server resulting in a loss of integrity.
Classification
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
OSVDB:
Web Related
Solution
Upgrade to version 4.3.10 or 5.0.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
php.net -