CVE-2009-2626

Name	CVE-2009-2626
Description	The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1940-1
Debian Bugs	540605

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
php5 (PTS)	jessie, jessie (lts)	5.6.40+dfsg-0+deb8u21	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
php5	source	etch	5.2.0+dfsg-8+etch16		DSA-1940-1
php5	source	lenny	5.2.6.dfsg.1-1+lenny4		DSA-1940-1
php5	source	(unstable)	5.2.11.dfsg.1-1	low		540605

[etch] - php5 <no-dsa> (too risky to fix it there)
requires the script itself to set and then restore a config var