Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0755 to the following vulnerability: Name: CVE-2011-0755 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0755 Assigned: 20110202 Reference: CONFIRM: http://bugs.php.net/46587 Reference: CONFIRM: http://www.php.net/ChangeLog-5.php Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.
Statement: Red Hat does not consider this flaw to be a security issue as arguments passed to the mt_rand function are under the full control of the script author. No trust boundary is crossed. This flaw exists in the php53 packages versions as shipped in Red Hat Enterprise Linux 5 and the php packages versions as shipped in Red Hat Enterprise Linux 6.
Closing as not-a-security-bug. As noted in the upstream bug, affected function returned random numbers from the specified range, but without enforcing which argument is minimal an which is maximal value.