CVE-2007-0988
published 2007-02-20CVE-2007-0988: The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a…
PriorityP414medium4.3CVSS 2.0
AVNACMAuNCNINAP
EPSS
2.31%
81.4th percentile
The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| php | php | — | — |
| php | php | >= 4.0.0 < 4.4.5 | 4.4.5 |
| php | php | >= 5.0.0 < 5.2.1 | 5.2.1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
vendor_ubuntu7.5HIGH
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP regression
vendor_ubuntu·2007-03-08·CVSS 7.5
[HIGH] PHP regression
Title: PHP regression
Summary: PHP regression
USN-424-1 fixed vulnerabilities in PHP. However, some upstream changes
were not included, which caused errors in the stream filters. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple buffer overflows have been discovered in various PHP modules.
If a PHP application processes untrusted data with functions of the
session or zip module, or various string functions, a remote attacker
could exploit this to execute arbitrary code with the privileges of
the web server. (CVE-2007-0906)
The sapi_header_op() function had a buffer underflow that could be
exploited to crash the PHP interpreter. (CVE-2007-0907)
The wddx unserialization handler did not correctly check for some
buffer boundaries and
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2007-02-22·CVSS 7.5
CVE-2007-0906 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP vulnerabilities
Multiple buffer overflows have been discovered in various PHP modules.
If a PHP application processes untrusted data with functions of the
session or zip module, or various string functions, a remote attacker
could exploit this to execute arbitrary code with the privileges of
the web server. (CVE-2007-0906)
The sapi_header_op() function had a buffer underflow that could be
exploited to crash the PHP interpreter. (CVE-2007-0907)
The wddx unserialization handler did not correctly check for some
buffer boundaries and had an uninitialized variable. By unserializing
untrusted data, this could be exploited to expose memory regions that
were not meant to be accessible. Depending on the PHP application this
could lead to disclosure of pot
Red Hat
security flaw
vendor_redhat·2007-02-14·CVSS 4.3
CVE-2007-0988 [MEDIUM] security flaw
security flaw
The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.
GHSA
GHSA-rv23-gf9q-6frc: The zend_hash_init function in PHP 5 before 5
ghsa_unreviewed·2022-05-03
CVE-2007-0988 [MEDIUM] CWE-119 GHSA-rv23-gf9q-6frc: The zend_hash_init function in PHP 5 before 5
The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-0988 security flaw
bugzilla·2018-08-16·CVSS 4.3
CVE-2007-0988 [MEDIUM] CVE-2007-0988 security flaw
CVE-2007-0988 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service (infinite loop) by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a negative value, as demonstrated by an "a:2147483649:{" argument.
Bugzilla
CVE-2007-1285 "Month of PHP Bugs" security issues (CVE-2007-1286 CVE-2007-1583 CVE-2007-1711 CVE-2007-1718)
bugzilla·2007-03-01·CVSS 2.1
CVE-2007-1285 [LOW] CVE-2007-1285 "Month of PHP Bugs" security issues (CVE-2007-1286 CVE-2007-1583 CVE-2007-1711 CVE-2007-1718)
CVE-2007-1285 "Month of PHP Bugs" security issues (CVE-2007-1286 CVE-2007-1583 CVE-2007-1711 CVE-2007-1718)
Description of problem:
This bug will be used to provide tracking information for the issues reported
during the "Month of PHP Bugs" initiative, http://www.php-security.org/
Discussion:
Introduction: The PHP interpreter does not offer a reliable
"sandboxed" security layer (as found in, say, a JVM) in which
untrusted scripts can be run; any script run by the PHP interpreter
must be trusted with the privileges of the interpreter itself. In
analysis of these issues, bugs which rely on an "untrusted local
attacker" will therefore not be classified as being
security-sensitive, since no trust boundary is crossed.
---
MOPB-01-2007 describes an issue in the PHP interpreter regarding the
Bugzilla
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
bugzilla·2007-02-23·CVSS 7.5
CVE-2007-0906 [HIGH] CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2007-0089.html
Bugzilla
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
bugzilla·2007-02-20·CVSS 7.5
CVE-2007-0906 [HIGH] CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHSA-2007-0081.html
Bugzilla
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
bugzilla·2007-02-20·CVSS 7.5
CVE-2007-0906 [HIGH] CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
+++ This bug was initially created as a clone of Bug #228858 +++
Description of problem:
1. If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop,
consuming CPU resources, for a limited length of time, until the
script timeout alarm aborts the script (CVE-2007-0988)
2. If a script uses the imap_mail_compose() function to create a new MIME
message based on an input body from an untrusted source, an attacker may be able
to force a heap overflow (CVE-2006-0906)
3. If the format string could passed to one of the functions in the printf()
family could be controlled by an attacker via untrusted data, then an
out-of-b
Bugzilla
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
bugzilla·2007-02-16·CVSS 7.5
CVE-2007-0906 [HIGH] CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
+++ This bug was initially created as a clone of Bug #228858 +++
Description of problem:
1. If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop,
consuming CPU resources, for a limited length of time, until the
script timeout alarm aborts the script (CVE-NO-NAME)
2. If a script uses the imap_mail_compose() function to create a new MIME
message based on an input body from an untrusted source, an attacker may be able
to force a heap overflow (CVE-2006-0906)
3. If the format string could passed to one of the functions in the printf()
family could be controlled by an attacker via untrusted data, then an
out-of-bou
Bugzilla
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
bugzilla·2007-02-15·CVSS 7.5
CVE-2007-0906 [HIGH] CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
CVE-2007-0906 PHP security issues (CVE-2007-0907, CVE-2007-0908, CVE-2007-0909, CVE-2007-0910, CVE-2007-0988)
Description of problem:
1. If unserializing untrusted data on 64-bit platforms the
zend_hash_init() function can be forced to enter an infinite loop,
consuming CPU resources, for a limited length of time, until the
script timeout alarm aborts the script (CVE-NO-NAME)
2. If a script uses the imap_mail_compose() function to create a new MIME
message based on an input body from an untrusted source, an attacker may be able
to force a heap overflow (CVE-2006-0906)
3. If the format string could passed to one of the functions in the printf()
family could be controlled by an attacker via untrusted data, then an
out-of-bounds memory read could crash the Apache child process (CVE-2006-090
ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.aschttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228858http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137http://osvdb.org/32762http://rhn.redhat.com/errata/RHSA-2007-0089.htmlhttp://secunia.com/advisories/24195http://secunia.com/advisories/24217http://secunia.com/advisories/24236http://secunia.com/advisories/24248http://secunia.com/advisories/24284http://secunia.com/advisories/24295http://secunia.com/advisories/24322http://secunia.com/advisories/24419http://secunia.com/advisories/24421http://secunia.com/advisories/24432http://secunia.com/advisories/24606http://secunia.com/advisories/24642http://secunia.com/advisories/25056http://secunia.com/advisories/25423http://secunia.com/advisories/25850http://security.gentoo.org/glsa/glsa-200703-21.xmlhttp://securityreason.com/securityalert/2315http://support.avaya.com/elmodocs2/security/ASA-2007-101.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-136.htmhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:048http://www.novell.com/linux/security/advisories/2007_32_php.htmlhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.htmlhttp://www.php-security.org/MOPB/MOPB-05-2007.htmlhttp://www.php.net/releases/5_2_1.phphttp://www.redhat.com/support/errata/RHSA-2007-0076.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0081.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0082.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0088.htmlhttp://www.securityfocus.com/archive/1/461462/100/0/threadedhttp://www.securitytracker.com/id?1017671http://www.trustix.org/errata/2007/0009/http://www.ubuntu.com/usn/usn-424-1http://www.ubuntu.com/usn/usn-424-2http://www.us.debian.org/security/2007/dsa-1264http://www.vupen.com/english/advisories/2007/1991http://www.vupen.com/english/advisories/2007/2374https://exchange.xforce.ibmcloud.com/vulnerabilities/32709https://issues.rpath.com/browse/RPL-1088https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11092ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.aschttp://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228858http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137http://osvdb.org/32762http://rhn.redhat.com/errata/RHSA-2007-0089.htmlhttp://secunia.com/advisories/24195http://secunia.com/advisories/24217http://secunia.com/advisories/24236http://secunia.com/advisories/24248http://secunia.com/advisories/24284http://secunia.com/advisories/24295http://secunia.com/advisories/24322http://secunia.com/advisories/24419http://secunia.com/advisories/24421http://secunia.com/advisories/24432http://secunia.com/advisories/24606http://secunia.com/advisories/24642http://secunia.com/advisories/25056http://secunia.com/advisories/25423http://secunia.com/advisories/25850http://security.gentoo.org/glsa/glsa-200703-21.xmlhttp://securityreason.com/securityalert/2315http://support.avaya.com/elmodocs2/security/ASA-2007-101.htmhttp://support.avaya.com/elmodocs2/security/ASA-2007-136.htmhttp://www.mandriva.com/security/advisories?name=MDKSA-2007:048http://www.novell.com/linux/security/advisories/2007_32_php.htmlhttp://www.openpkg.com/security/advisories/OpenPKG-SA-2007.010.htmlhttp://www.php-security.org/MOPB/MOPB-05-2007.htmlhttp://www.php.net/releases/5_2_1.phphttp://www.redhat.com/support/errata/RHSA-2007-0076.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0081.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0082.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0088.htmlhttp://www.securityfocus.com/archive/1/461462/100/0/threadedhttp://www.securitytracker.com/id?1017671http://www.trustix.org/errata/2007/0009/http://www.ubuntu.com/usn/usn-424-1http://www.ubuntu.com/usn/usn-424-2http://www.us.debian.org/security/2007/dsa-1264http://www.vupen.com/english/advisories/2007/1991http://www.vupen.com/english/advisories/2007/2374https://exchange.xforce.ibmcloud.com/vulnerabilities/32709https://issues.rpath.com/browse/RPL-1088https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11092
2007-02-20
Published