A flaw was found in the way the max_input_vars directive was implemented in php, as a fix for CVE-2011-4885 (php: hash table collisions CPU usage DoS issue). A remote attacker could send large number of crafted POST requests, which could crash php or execute arbitrary code with the permissions of the user running php. Possible upstream patch: http://svn.php.net/viewvc?view=revision&revision=323007 Reference: http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/
http://www.h-online.com/security/news/item/Critical-PHP-vulnerability-being-fixed-1427316.html
Following page links errata that has been released for Red Hat Enterprise Linux to address CVE-2011-4885 which introduce this issue: https://www.redhat.com/security/data/cve/CVE-2011-4885.html Work on packages addressing CVE-2012-0830 is in progress. In the meantime, this issue can be mitigated by downgrading php or php53 packages to versions preceding updates listed in the errata for CVE-2011-4885.
Created php tracking bugs for this issue Affects: fedora-all [bug 786988]
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2012:0092 https://rhn.redhat.com/errata/RHSA-2012-0092.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2012:0093 https://rhn.redhat.com/errata/RHSA-2012-0093.html
Fedora updates to PHP version 5.3.10 were built and submitted: https://admin.fedoraproject.org/updates/search/CVE-2012-0830
php-eaccelerator-0.9.6.1-9.fc16.2, maniadrive-1.2-32.fc16.2, php-5.3.10-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
php-eaccelerator-0.9.6.1-9.fc15.2, maniadrive-1.2-32.fc15.2, php-5.3.10-1.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.