CVE-2008-1384

Name	CVE-2008-1384
Description	Integer overflow in PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service and possibly have unspecified other impact via a printf format parameter with a large width specifier, related to the php_sprintf_appendstring function in formatted_print.c and probably other functions for formatted strings (aka *printf functions).
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1572-1, DTSA-135-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php5 (PTS)	jessie, jessie (lts)	5.6.40+dfsg-0+deb8u21	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
php5	source	etch	5.2.0-8+etch11	DSA-1572-1
php5	source	lenny	5.2.5-3+lenny1	DTSA-135-1
php5	source	(unstable)	5.2.6-1

Notes

http://securityreason.com/achievement_securityalert/52
Only exploitable through malicious script
http://cvs.php.net/viewvc.cgi/php-src/ext/standard/formatted_print.c?r1=1.104&r2=1.105&diff_format=u