Stefan Esser Month of PHP Bugs project is going strong and here are five more vulnerabilities exposed on March 2nd 2007 :

4. PHP 4 unserialize() ZVAL Reference Counter Overflow During unserialisation of user supplied data that contains a lot of references to a variable the internal 16bit zval reference counter can overflow. This leads to an exploitable double dtor condition.
5. PHP unserialize() 64 bit Array Creation Denial of Service Vulnerability Deserialisation of malformed PHP arrays from within unserialize() might result in a tight endless loop exhausting CPU ressources on 64bit systems.
6. Zend Platform Insecure File Permission Local Root Vulnerability Several binaries and shellscripts installed by the Zend Platform are installed with unsafe permissions that might allow an attacker to gain root privileges.
7. Zend Platform ini_modifier Local Root Vulnerability The ini_modifier of the Zend Platform can be tricked by a local to edit the system php.ini file, which can be used to obtain root privileges.
8. PHP 4 phpinfo() XSS Vulnerability (Deja-vu) phpinfo() does not escape the content of user supplied arrays in GET, POST or COOKIE variables when it displays them which leads to an XSS vulnerability.