Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:2820
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Organization: esoft ApS
To: internals@lists.php.net
Date: Thu, 26 Jun 2003 11:53:48 +0200
User-Agent: KMail/1.5.2
MIME-Version: 1.0
Content-Type: Text/Plain;
  charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Content-Description: clearsigned data
Content-Disposition: inline
Message-ID: <200306261153.51981.simon@esoft.dk>
Subject: Serious PHP crash, vaulnarable for every script.
From: simon@esoft.dk (Simon Ejsing)

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

	I've discovered a serious flaw and possibly a security issue in PHP. It is=
=20
possible, by making a simple request to a PHP page, to crash the PHP thread=
=20
with a Segmentation fault, no matter what the script does as it crashes=20
before execution.

	I'm using PHP version 4.3.2 with Apache 2.0.46 on Linux, and have not foun=
d=20
anything about this issue in the bug system. I have not tested with any oth=
er=20
version, nor have I looked into a specific configuration to avoid this=20
problem.

	I'm not sure where to report this issue, I don't want to explain how to do=
=20
this to everyone, so if I could contact a developer personally I could=20
explain the simple procedure.

=2D --=20
Simon Ejsing, Systemudvikler
esoft ApS, http://www.esoft.dk
Kongensgade 66-68, DK-5000 Odense C.
Tlf: 70 222 466, Fax: 63 122 466
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE++sKv0ZtqfKNZvaARAvs1AJwJpkBTVJLkPB1bSgbXM+it0ophyACfcAgL
bp/REaKd9w792qGx6D7WYRE=3D
=3DyiK0
=2D----END PGP SIGNATURE-----