CVE-2009-2626
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions...
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
Exploit likelihood
What each source reports
NVD Score used
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
- Record
CVE-2009-2626- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
- Record
CVE-2009-2626- Updated
- 2026-11-02
EUVDEUVD-2009-2620 No score
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
- Record
EUVD-2009-2620- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5c54-wvq7-976j No score
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions...
The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the ini_restore function to restore the variable.
- Record
GHSA-5c54-wvq7-976j- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Debian:4.0 |
before 5.2.0+dfsg-8+etch16, plus listed versions 5.2.0+dfsg-8+etch155.2.0-105.2.0-10+lenny15.2.0-115.2.0-8+etch1 Show 13 moreShow less5.2.0-8+etch105.2.0-8+etch115.2.0-8+etch11~p15.2.0-8+etch135.2.0-8+etch35.2.0-8+etch45.2.0-8+etch5~pu15.2.0-8+etch65.2.0-8+etch75.2.0-8+etch85.2.0-8+etch95.2.0-8+etch9~bpo31+15.2.0-9 |
5.2.0+dfsg-8+etch16 |
php5Debian:5.0 |
before 5.2.6.dfsg.1-1+lenny4, plus listed versions 5.2.6.dfsg.1-1+lenny25.2.6.dfsg.1-1+lenny3 |
5.2.6.dfsg.1-1+lenny4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP 5.2.10/5.3.0 - 'ini_restore()' Memory Information Disclosure | 2009-12-03 |
| Exploit-DB | PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (1) | 2009-08-10 |
| Exploit-DB | PHP 5.2.10/5.3 - 'ini_restore()' Memory Information Disclosure (2) | 2009-08-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2626 is a medium vulnerability (CVSS 6.4) in Php, published November 25, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.31%, the 94th percentile. Fixed in php5 5.2.0+dfsg-8+etch16.
References
secunia.com/advisories/37482
debian.org/security/2009/dsa-1940
bugs.debian.org/cgi-bin/bugreport.cgi?bug=540605
svn.php.net/viewvc/php/php-src/branches/PHP_5_3/Zend/zend_ini.c?r1=272370&r2=284156
securityfocus.com/bid/36009
securityreason.com/achievement_securityalert/65
nvd.nist.gov/vuln/detail/CVE-2009-2626
github.com/advisories/GHSA-5c54-wvq7-976j