CVE-2007-1285

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2007-1285
The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://www.php-security.org/MOPB/MOPB-03-2007.html Broken Link Exploit Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0082.html Broken Link
http://www.securityfocus.com/bid/22764 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1017771 Broken Link Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2007-0154.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2007-0155.html Third Party Advisory
http://secunia.com/advisories/24910 Broken Link Vendor Advisory
http://secunia.com/advisories/24924 Broken Link Vendor Advisory
https://issues.rpath.com/browse/RPL-1268 Broken Link
http://rhn.redhat.com/errata/RHSA-2007-0163.html Broken Link
http://www.redhat.com/support/errata/RHSA-2007-0162.html Broken Link
http://secunia.com/advisories/24945 Broken Link Vendor Advisory
http://secunia.com/advisories/24941 Broken Link Vendor Advisory
http://us2.php.net/releases/4_4_7.php Release Notes
http://us2.php.net/releases/5_2_2.php Release Notes
http://secunia.com/advisories/24909 Broken Link Vendor Advisory
http://www.php.net/ChangeLog-5.php#5.2.4 Release Notes
http://www.php.net/releases/5_2_4.php Release Notes
https://launchpad.net/bugs/173043 Exploit Issue Tracking
http://security.gentoo.org/glsa/glsa-200705-19.xml Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html Mailing List
http://www.ubuntu.com/usn/usn-549-2 Third Party Advisory
http://www.osvdb.org/32769 Broken Link
http://secunia.com/advisories/25445 Broken Link Vendor Advisory
http://secunia.com/advisories/26048 Broken Link Vendor Advisory
http://secunia.com/advisories/26642 Broken Link Vendor Advisory
http://secunia.com/advisories/27864 Broken Link Vendor Advisory
http://www.php.net/ChangeLog-4.php Release Notes
http://www.php.net/releases/4_4_8.php Release Notes
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136 Broken Link
http://secunia.com/advisories/28936 Broken Link Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017 Broken Link
https://usn.ubuntu.com/549-1/ Broken Link
http://www.securityfocus.com/archive/1/466166/100/0/threaded Broken Link Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:novell:suse_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux:10.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp1:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*
History

02 Feb 2024, 14:03

Type Values Removed Values Added
CWE CWE-119 CWE-674
First Time Novell
Suse linux Enterprise Server
Redhat enterprise Linux Desktop
Redhat enterprise Linux Workstation
Canonical
Canonical ubuntu Linux
Redhat enterprise Linux Server
Novell suse Linux
Suse
Redhat
CPE cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.1.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc4:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.4:patch1:*:*:*:*:*:*
cpe:2.3:a:zend:engine:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*		 cpe:2.3:o:suse:linux_enterprise_server:10:sp1:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux:10.1:*:*:*:*:*:*:*
CVSS v2 : 5.0
v3 : unknown 		v2 : 5.0
v3 : 7.5
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0155.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0155.html - Third Party Advisory
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0162.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0162.html - Broken Link
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 - Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0163.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0163.html - Broken Link
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0154.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2007-0154.html - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/24909 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/24909 - Broken Link, Vendor Advisory
References (CONFIRM) http://www.php.net/releases/4_4_8.php - (CONFIRM) http://www.php.net/releases/4_4_8.php - Release Notes
References (CONFIRM) https://launchpad.net/bugs/173043 - (CONFIRM) https://launchpad.net/bugs/173043 - Exploit, Issue Tracking
References (BUGTRAQ) http://www.securityfocus.com/archive/1/466166/100/0/threaded - (BUGTRAQ) http://www.securityfocus.com/archive/1/466166/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) http://www.php.net/ChangeLog-5.php#5.2.4 - (CONFIRM) http://www.php.net/ChangeLog-5.php#5.2.4 - Release Notes
References (CONFIRM) http://us2.php.net/releases/4_4_7.php - (CONFIRM) http://us2.php.net/releases/4_4_7.php - Release Notes
References (BID) http://www.securityfocus.com/bid/22764 - (BID) http://www.securityfocus.com/bid/22764 - Broken Link, Third Party Advisory, VDB Entry
References (SECTRACK) http://www.securitytracker.com/id?1017771 - (SECTRACK) http://www.securitytracker.com/id?1017771 - Broken Link, Third Party Advisory, VDB Entry
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html - Mailing List
References (REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0082.html - (REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0082.html - Broken Link
References (CONFIRM) http://www.php.net/ChangeLog-4.php - (CONFIRM) http://www.php.net/ChangeLog-4.php - Release Notes
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 - Third Party Advisory
References (UBUNTU) http://www.ubuntu.com/usn/usn-549-2 - (UBUNTU) http://www.ubuntu.com/usn/usn-549-2 - Third Party Advisory
References (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017 - (OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017 - Broken Link
References (SECUNIA) http://secunia.com/advisories/27864 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/27864 - Broken Link, Vendor Advisory
References (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 - (MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/24924 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/24924 - Broken Link, Vendor Advisory
References (CONFIRM) https://issues.rpath.com/browse/RPL-1268 - (CONFIRM) https://issues.rpath.com/browse/RPL-1268 - Broken Link
References (OSVDB) http://www.osvdb.org/32769 - (OSVDB) http://www.osvdb.org/32769 - Broken Link
References (SECUNIA) http://secunia.com/advisories/24945 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/24945 - Broken Link, Vendor Advisory
References (UBUNTU) https://usn.ubuntu.com/549-1/ - (UBUNTU) https://usn.ubuntu.com/549-1/ - Broken Link
References (MISC) http://www.php-security.org/MOPB/MOPB-03-2007.html - Exploit, Vendor Advisory (MISC) http://www.php-security.org/MOPB/MOPB-03-2007.html - Broken Link, Exploit, Vendor Advisory
References (GENTOO) http://security.gentoo.org/glsa/glsa-200705-19.xml - (GENTOO) http://security.gentoo.org/glsa/glsa-200705-19.xml - Third Party Advisory
References (SECUNIA) http://secunia.com/advisories/26642 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/26642 - Broken Link, Vendor Advisory
References (SECUNIA) http://secunia.com/advisories/25445 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/25445 - Broken Link, Vendor Advisory
References (SECUNIA) http://secunia.com/advisories/26048 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/26048 - Broken Link, Vendor Advisory
References (SECUNIA) http://secunia.com/advisories/24941 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/24941 - Broken Link, Vendor Advisory
References (CONFIRM) http://www.php.net/releases/5_2_4.php - (CONFIRM) http://www.php.net/releases/5_2_4.php - Release Notes
References (SECUNIA) http://secunia.com/advisories/28936 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/28936 - Broken Link, Vendor Advisory
References (CONFIRM) http://us2.php.net/releases/5_2_2.php - (CONFIRM) http://us2.php.net/releases/5_2_2.php - Release Notes
References (SECUNIA) http://secunia.com/advisories/24910 - Vendor Advisory (SECUNIA) http://secunia.com/advisories/24910 - Broken Link, Vendor Advisory
References (SLACKWARE) http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136 - (SLACKWARE) http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136 - Broken Link
Information

Published : 2007-03-06 20:19

Updated : 2024-02-02 14:03

NVD link : CVE-2007-1285

Mitre link : CVE-2007-1285

JSON object : View

Products Affected

php

  • php

canonical

  • ubuntu_linux

redhat

  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_workstation

novell

  • suse_linux

suse

  • linux_enterprise_server
CWE
CWE-674

Uncontrolled Recursion