CVE-2006-3017
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause...
9.3 HighFix available
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
Exploit likelihood
4.14%Up 1.5 points since Feb 4, 2022
What each source reports
NVD Score used
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
- Record
CVE-2006-3017- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
- Record
CVE-2006-3017- Updated
- 2026-11-02
EUVDEUVD-2006-3014 No score
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
- Record
EUVD-2006-3014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vx7j-rxcm-25x5 No score
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause...
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
- Record
GHSA-vx7j-rxcm-25x5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php4Debian:3.1 |
before 4:4.3.10-18, plus listed versions 4:4.3.10-154:4.3.10-164:4.3.10-17 |
4:4.3.10-18 |
phpRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-debuginfoRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-develRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-imapRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-ldapRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-mysqlRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-odbcRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-pgsqlRed Hat:enterprise_linux:3::as |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
phpRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
Show 83 moreShow less
| Package | Affected | Fixed |
|---|---|---|
php-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-develRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-imapRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-ldapRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-mysqlRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-odbcRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-pgsqlRed Hat:enterprise_linux:3::desktop |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
phpRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-debuginfoRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-develRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-imapRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-ldapRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-mysqlRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-odbcRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-pgsqlRed Hat:enterprise_linux:3::es |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
phpRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-develRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-imapRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-ldapRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-mysqlRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-odbcRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
php-pgsqlRed Hat:enterprise_linux:3::ws |
before 0:4.3.2-33.ent | 0:4.3.2-33.ent |
phpRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-debuginfoRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-develRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-domxmlRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-gdRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-imapRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ldapRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mbstringRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mysqlRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ncursesRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-odbcRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pearRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pgsqlRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-snmpRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-xmlrpcRed Hat:enterprise_linux:4::as |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
phpRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-develRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-domxmlRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-gdRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-imapRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ldapRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mbstringRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mysqlRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ncursesRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-odbcRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pearRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pgsqlRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-snmpRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-xmlrpcRed Hat:enterprise_linux:4::desktop |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
phpRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-debuginfoRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-develRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-domxmlRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-gdRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-imapRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ldapRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mbstringRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mysqlRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ncursesRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-odbcRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pearRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pgsqlRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-snmpRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-xmlrpcRed Hat:enterprise_linux:4::es |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
phpRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-develRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-domxmlRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-gdRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-imapRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ldapRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mbstringRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-mysqlRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-ncursesRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-odbcRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pearRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-pgsqlRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-snmpRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
php-xmlrpcRed Hat:enterprise_linux:4::ws |
before 0:4.3.9-3.15 | 0:4.3.9-3.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3017 is a high vulnerability (CVSS 9.3) in Php, published June 14, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.14%, the 90th percentile. Fixed in php4 4:4.3.10-18.
References
secunia.com/advisories/21723
issues.rpath.com/browse/RPL-683
cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&view=log
turbolinux.com/security/2006/TLSA-2006-38.txt
Show 49 moreShow less
debian.org/security/2006/dsa-1206
novell.com/linux/security/advisories/2006_31_php.html
securityfocus.com/archive/1/442437/100/0/threaded
osvdb.org/26466
redhat.com/support/errata/RHSA-2006-0568.html
php.net/release_5_1_3.php
securitytracker.com/id?1016649
rhn.redhat.com/errata/RHSA-2006-0549.html
mandriva.com/security/advisories?name=MDKSA-2006:122
exchange.xforce.ibmcloud.com/vulnerabilities/27396
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10118
hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html
support.avaya.com/elmodocs2/security/ASA-2006-175.htm
usn.ubuntu.com/320-1
archives.neohapsis.com/archives/fulldisclosure/2006-08/0166.html
nvd.nist.gov/vuln/detail/CVE-2006-3017
github.com/advisories/GHSA-vx7j-rxcm-25x5
access.redhat.com/errata/RHSA-2006:0568
bugzilla.redhat.com/show_bug.cgi?id=189591
security.access.redhat.com/data/csaf/v2/advisories/2006/rhsa-2006_0568.json
cve.org/CVERecord?id=CVE-2006-1494