CVE-2008-7068

The dba_replace function in PHP 5.2.6 and 4.x allows context-dependent
attackers to cause a denial of service (file truncation) via a key with the
NULL byte. NOTE: this might only be a vulnerability in limited
circumstances in which the attacker can modify or add database entries but
does not have permissions to truncate the file.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507101&gt;