Versions of PHP earlier than 5.3.9 are potentially affected by multiple vulnerabilities :
It is possible to create a denial of service condition by sending multiple, specially crafted requests containing parameter values that cause hash collisions when computing the hash values for storage in a hash table. (CVE-2011-4885)
An integer overflow exists in the exif_process_IFD_TAG function in exif.c that can allow a remote attacker to read arbitrary memory locations or cause a denial of service condition. This vulnerability only affects PHP 5.4.0beta2 on 32-bit platforms. (CVE-2011-4566)
Calls to libxslt are not restricted via xsltSetSecurityPrefs(), which could allow an attacker to create or overwrite file, resulting in arbitrary code execution. (CVE-2012-0057)
An error exists in the function ‘tidy_diagnose’ that can allow an attacker to cause the application to dereference a null pointer. This causes the application to crash. (CVE-2012-0781)
The ‘PDORow’ implementation contains an error that can cause application crashes when interacting with the session feature. C(VE-2012-0788)
An error exists in the timezone handling such that repeated calls to the function ‘strtotime’ can allow a denial of service attack via memory consuption. (CVE-2012-0789)
Binary data 801116.prm
archives.neohapsis.com/archives/bugtraq/2012-01/0092.html
.php.net/archive/2012.php#id2012-01-11-1
.php.net/ChangeLog-5.php#5.3.9
.php.net/releases/5.3.9.php
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4566
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0057
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0781
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0788
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0789
xhe.myxwiki.org/xwiki/bin/view/XSLT/Application_PHP5