Mandriva Linux Security Advisory : php

CVE-2011-3379 is a code-injection flaw in PHP's is_a() function, introduced in PHP 5.3.7 and fixed in 5.3.9. When is_a() is called with a class name that hasn't been loaded yet, it triggers __autoload(). If the application uses an unsafe autoloader — particularly certain PEAR packages that pass unsanitized input to include() or require() — a remote attacker can supply a crafted URL parameter to load and execute arbitrary code. The affected range is exclusively PHP 5.3.7 and 5.3.8 on Mandriva Linux 2010.1 and 2011. Mandriva S.A. was liquidated in May 2015. The OS has received zero security updates for over 11 years. PHP 5.3 reached end-of-life on 14 August 2014.

The vendor severity of HIGH (CVSS v2 7.5) was reasonable *in 2011* for the narrow window when PHP 5.3.7/5.3.8 shipped. But in September 2026, this Tenable plugin fires on a distribution with no living support infrastructure. The finding is completely unactionable as a patch operation — Mandriva's repositories are offline, its mirrors are dead, and even if you sourced the old SRPM, you'd be applying a 15-year-old patch to an OS riddled with hundreds of other unpatched CVEs. Red Hat marked RHEL as not affected. Ubuntu marked all releases as not affected. The only hosts that trigger this plugin are Mandriva zombies that should have been decommissioned a decade ago. Treating this as a HIGH-severity finding pollutes your patch queue and buries real risk.

1. IGNORE 0.0→IGNORE 0.0
   Decommission the Mandriva host immediately — This is not a compensating control — it is the *only* remediation. A host running Mandriva Linux 2010.1/2011 in 2026 is beyond patching. It has 11+ years of unpatched vulnerabilities across every component. Migrate any workloads to a supported OS (RHEL 9, Ubuntu 24.04 LTS, Debian 12). This should be treated as an emergency decommission regardless of the noisgate SLA, because the host itself is the vulnerability.
2. IGNORE 0.0→IGNORE 0.0
   Network-isolate the host pending decommission — If immediate decommission is blocked by a workload dependency, place the host in a quarantine VLAN with no inbound access from untrusted networks and no outbound internet. Apply firewall rules to allow only the minimum required traffic. This eliminates the network attack vector for CVE-2011-3379 and hundreds of other unpatched CVEs on this host. Implement within hours, not days.
3. IGNORE 0.0→IGNORE 0.0
   Disable PHP if not required — If the Mandriva host must temporarily remain online and PHP is not required for its function, stop the Apache/PHP service (service httpd stop) and remove it from startup. This eliminates the entire PHP attack surface, including CVE-2011-3379.

Run this script directly on the suspect host (requires root or read access to /etc/mandriva-release and php --version). Invoke with: sudo bash check_cve_2011_3379.sh. No network access or external dependencies required.

#!/usr/bin/env bash
# check_cve_2011_3379.sh
# Checks for CVE-2011-3379: PHP is_a() autoload on Mandriva Linux
# Affected: PHP 5.3.7 and 5.3.8 on Mandriva Linux 2010.1 / 2011
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

VULNERABLE=0
PATCHED=1
UNKNOWN=2

# Check if this is Mandriva Linux
if [[ ! -f /etc/mandriva-release ]]; then
  echo "PATCHED — Not a Mandriva Linux host. CVE-2011-3379 (MDVSA-2011:166) does not apply."
  exit $PATCHED
fi

MDV_RELEASE=$(cat /etc/mandriva-release 2>/dev/null || echo "unknown")
echo "Detected Mandriva release: $MDV_RELEASE"

# Check if PHP is installed
if ! command -v php &>/dev/null; then
  echo "PATCHED — PHP is not installed on this Mandriva host."
  exit $PATCHED
fi

# Get PHP version
PHP_VERSION=$(php -r 'echo PHP_VERSION;' 2>/dev/null || echo "unknown")
echo "Detected PHP version: $PHP_VERSION"

if [[ "$PHP_VERSION" == "unknown" ]]; then
  echo "UNKNOWN — Could not determine PHP version."
  exit $UNKNOWN
fi

# CVE-2011-3379 affects exactly PHP 5.3.7 and 5.3.8
case "$PHP_VERSION" in
  5.3.7*|5.3.8*)
    echo "VULNERABLE — PHP $PHP_VERSION on Mandriva is affected by CVE-2011-3379."
    echo "WARNING: Mandriva Linux is EOL since 2015. This host cannot be patched."
    echo "ACTION: Decommission this host immediately."
    exit $VULNERABLE
    ;;
  5.3.9*|5.3.1[0-9]*|5.[4-9]*|[6-9]*|[1-9][0-9]*)
    echo "PATCHED — PHP $PHP_VERSION is not affected by CVE-2011-3379 (fixed in 5.3.9)."
    echo "WARNING: This host is still running Mandriva Linux, which is EOL since 2015."
    exit $PATCHED
    ;;
  *)
    echo "PATCHED — PHP $PHP_VERSION predates the vulnerable is_a() change (introduced in 5.3.7)."
    echo "WARNING: This host is still running Mandriva Linux, which is EOL since 2015."
    exit $PATCHED
    ;;
esac

1. Tenable Plugin 56708
2. NVD — CVE-2011-3379
3. Snyk — CVE-2011-3379 in PHP
4. Red Hat — CVE-2011-3379 (Not Affected)
5. Ubuntu — CVE-2011-3379 (Not Affected)
6. FIRST EPSS — CVE-2011-3379
7. Wikipedia — Mandriva Linux (EOL History)
8. PCWorld — Mandriva Linux Is Dead