CVE-2007-2728
published 2007-05-16CVE-2007-2728: The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the…
PriorityP419medium5CVSS 2.0
AVNACLAuNCPINAN
EPSS
2.42%
82.6th percentile
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PHP vulnerabilities
vendor_ubuntu·2007-07-17·CVSS 7.5
CVE-2007-1864 [HIGH] PHP vulnerabilities
Title: PHP vulnerabilities
Summary: PHP vulnerabilities
It was discovered that the PHP xmlrpc extension did not correctly check
heap memory allocation sizes. A remote attacker could send a specially
crafted request to a PHP application using xmlrpc and execute arbitrary
code as the Apache user. (CVE-2007-1864)
Stefan Esser discovered a flaw in the random number initialization of the
PHP SOAP extension. This could lead to remote attackers being able to
predict certain elements of the authentication mechanism. (CVE-2007-2728)
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
GHSA
GHSA-g6ph-v22v-23j6: The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mc
ghsa_unreviewed·2022-05-01·CVSS 2.6
CVE-2007-2728 [LOW] GHSA-g6ph-v22v-23j6: The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mc
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.htmlhttp://osvdb.org/36086http://secunia.com/advisories/25306http://secunia.com/advisories/26102http://secunia.com/advisories/26895http://www.mandriva.com/security/advisories?name=MDKSA-2007:187http://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://www.ubuntu.com/usn/usn-485-1http://www.vupen.com/english/advisories/2007/1839http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.htmlhttp://osvdb.org/36086http://secunia.com/advisories/25306http://secunia.com/advisories/26102http://secunia.com/advisories/26895http://www.mandriva.com/security/advisories?name=MDKSA-2007:187http://www.novell.com/linux/security/advisories/2007_15_sr.htmlhttp://www.ubuntu.com/usn/usn-485-1http://www.vupen.com/english/advisories/2007/1839
2007-05-16
Published