Every CVE Search/ Get API key

CVE-2006-4020

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to...

4.6 MediumPublic exploitFix available

CVE-2006-4020 is a medium vulnerability (CVSS 4.6) in Php, published August 8, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in php 0:4.3.2-36.ent.

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Exploit likelihood

2.01%Down 9.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.6

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Record
CVE-2006-4020
CVSS 2.0
4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Record
CVE-2006-4020
Updated
2026-11-02
EUVDEUVD-2006-4013 No score

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Record
EUVD-2006-4013
Updated
2026-11-03
GitHub AdvisoriesGHSA-ccmc-8626-x545 No score

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to...

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

Record
GHSA-ccmc-8626-x545
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-debuginfo
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-devel
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-imap
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-ldap
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-mysql
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-odbc
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-pgsql
Red Hat:enterprise_linux:3::as
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-debuginfo
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
Show 100 moreShow less
Affected packages
PackageAffectedFixed
php-devel
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-imap
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-ldap
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-mysql
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-odbc
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-pgsql
Red Hat:enterprise_linux:3::desktop
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-debuginfo
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-devel
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-imap
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-ldap
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-mysql
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-odbc
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-pgsql
Red Hat:enterprise_linux:3::es
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-debuginfo
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-devel
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-imap
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-ldap
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-mysql
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-odbc
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php-pgsql
Red Hat:enterprise_linux:3::ws
 before 0:4.3.2-36.ent
0:4.3.2-36.ent
php
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-devel
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-domxml
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-gd
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-imap
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ldap
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mbstring
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mysql
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ncurses
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-odbc
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pear
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pgsql
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-snmp
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-xmlrpc
Red Hat:enterprise_linux:4::as
 before 0:4.3.9-3.18
0:4.3.9-3.18
php
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-devel
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-domxml
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-gd
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-imap
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ldap
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mbstring
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mysql
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ncurses
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-odbc
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pear
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pgsql
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-snmp
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-xmlrpc
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.9-3.18
0:4.3.9-3.18
php
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-devel
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-domxml
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-gd
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-imap
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ldap
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mbstring
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mysql
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ncurses
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-odbc
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pear
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pgsql
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-snmp
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-xmlrpc
Red Hat:enterprise_linux:4::es
 before 0:4.3.9-3.18
0:4.3.9-3.18
php
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-devel
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-domxml
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-gd
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-imap
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ldap
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mbstring
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-mysql
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-ncurses
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-odbc
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pear
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-pgsql
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-snmp
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php-xmlrpc
Red Hat:enterprise_linux:4::ws
 before 0:4.3.9-3.18
0:4.3.9-3.18
php
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-bcmath
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-dba
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-debuginfo
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-devel
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-gd
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-imap
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-ldap
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-mbstring
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-mysql
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-ncurses
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-odbc
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-pdo
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-pgsql
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-snmp
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-soap
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-xml
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4
php-xmlrpc
Red Hat:rhel_application_stack:1
 before 0:5.1.4-1.el4s1.4
0:5.1.4-1.el4s1.4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP 4.4.3/5.1.4 - 'sscanf' Local Buffer Overflow2006-08-16

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 75 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open