CVE-2003-0172: Buffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other OSes, all...

Security readout for executives and security teams

This old PHP issue describes a buffer overflow in PHP 4.3.1, mainly reported on Windows. A remote attacker could trigger a crash and might execute arbitrary code by supplying an overly long filename argument. The record does not provide a CVSS score, confirmed patch details, or evidence of current active exploitation. Exposure is most likely on legacy systems still running PHP 4.3.1, especially Windows-hosted PHP applications where attacker-controlled input can influence the filename argument passed to openlog. The source bundle does not identify modern affected branches, distributions, or a complete product matrix. Prioritize remediation if any PHP 4.3.1 service remains reachable, because the reported impact includes remote crash and possible code execution. For organizations without legacy PHP 4.3.1, this is mainly an inventory validation and decommissioning concern. Mitigation focus: Inventory internet-facing and internal systems for PHP 4.3.1, especially on Windows.; Retire or upgrade unsupported PHP 4.3.1 deployments after checking vendor guidance.; Review application code for attacker-controlled values reaching openlog filename arguments..

Prepared

Jun 30, 2026, 21:35 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.