CVE-2015-1352: The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does n...

Security readout for executives and security teams

CVE-2015-1352 is a denial-of-service issue in PHP's PostgreSQL extension through PHP 5.6.7. A crafted table name can trigger a NULL pointer dereference, crashing the affected application process. The available sources do not show data theft, code execution, or confirmed active exploitation. Likely exposure is legacy PHP deployments at or before 5.6.7 with the PostgreSQL extension enabled, especially applications that pass user-influenced table names into pgsql-related operations. The source bundle does not provide CPEs or a complete vendor/version matrix. Prioritize remediation where legacy PHP systems support customer-facing or business-critical workflows. The issue is not known from the bundle to enable compromise, but a reachable crash can still create outage risk and may indicate unsupported PHP exposure. Mitigation focus: Apply vendor PHP updates from the relevant distribution advisory.; Verify the PHP fix corresponding to the referenced php-src commit is present.; Upgrade unsupported PHP 5.x systems to a supported branch..

Prepared

Jun 14, 2026, 05:11 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.