CVE-2011-1938PHP Memory Corruption
php: stack-based buffer overflow in socket_connect()
Published May 23, 2011 · Updated Mar 9, 2026 · Also known as DEBIAN-CVE-2011-1938, DEBIAN-CVE-2011-4566, DEBIAN-CVE-2011-4885, DEBIAN-CVE-2012-0057, DSA-2399-1
Key Facts
Patch immediately- CVE-2011-1938 is a high-severity vulnerability (CVSS 7.5 v2) affecting PHP, php5 (debian), php-bcmath (amazon) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 23% probability of exploitation in the next 30 days.
- Fixed versions are available, including PHP 0:5.3.3-3.el6_1.3, PHP 5.3.3-3.el6_1.3, PHP 5.3.8-3.19.amzn1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
23%
Higher than 97.7% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
42/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
3
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
- advisoryRHSA-2011:1423
- patch[oss-security] 20110523 CVE request: PHP socket_connect() - stack buffer overflow
- patch[oss-security] 20110524 Re: CVE request: PHP socket_connect() - stack buffer overflow
- patchhttp://svn.php.net/viewvc/php/php-src/trunk/ext/sockets/sockets.c?r1=311369&r2=311368&pathrev=311369
- patchhttp://svn.php.net/viewvc?view=revision&revision=311369
Description
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
Affected Products
102 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| PHPPHP | 5.3.3, 5.3.4, 5.3.5, 5.3.6 | 5.3.8-3.19.amzn1 |
| php5debian | See advisory | 5.3.3-7+squeeze5 |
| php-bcmathamazon | See advisory | 5.3.8-3.19.amzn1 |
| php-cliamazon | See advisory | 5.3.8-3.19.amzn1 |
| php-commonamazon | See advisory | 5.3.8-3.19.amzn1 |
Patched Releases
PHP
0:5.3.3-3.el6_1.3, 5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-bcmath
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-cli
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-common
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-dba
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-devel
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-embedded
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-enchant
5.3.3-3.el6_1.3
php-fpm
5.3.8-3.19.amzn1
php-gd
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-imap
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-intl
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-ldap
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-mbstring
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-mcrypt
5.3.8-3.19.amzn1
php-mssql
5.3.8-3.19.amzn1
php-mysql
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-odbc
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-pdo
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-pgsql
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-process
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-pspell
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-recode
5.3.3-3.el6_1.3
php-snmp
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
php-soap
5.3.3-3.el6_1.3, 5.3.8-3.19.amzn1
Timeline
Publicly disclosed
May 23, 2011
Last updated
Mar 9, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-121 Stack-based Buffer Overflow
References
- advisoryRHSA-2011:1423
- patch[oss-security] 20110523 CVE request: PHP socket_connect() - stack buffer overflow
- patch[oss-security] 20110524 Re: CVE request: PHP socket_connect() - stack buffer overflow
- patchsvn.php.net · sockets.c
- patchsvn.php.net · viewvc
FAQ
Common Questions.
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
Affected: PHP versions 5.3.3, 5.3.4, 5.3.5, 5.3.6; php5 (debian); php-bcmath (amazon), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including PHP 0:5.3.3-3.el6_1.3, PHP 5.3.3-3.el6_1.3, PHP 5.3.8-3.19.amzn1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2011-1938 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo