CVE-2007-1286
NoneCVSS
—
EPSS
40.4%
Published
Mar 6, 2007
CISA due date
—
The record
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:3.1 | php4 | 0 | 4:4.3.10-20 |
| Debian:4.0 | php4 | 0 | 6:4.4.4-8+etch2 |
| Debian:4.0 | php5 | 0 | 5.2.0-8+etch3 |
| Debian:5.0 | php4 | 0 | 6:4.4.4-9+lenny1 |
| Debian:5.0 | php5 | 0 | 5.2.0-10+lenny1 |
| Red Hat:enterprise_linux:2.1::as | php | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-devel | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-imap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-ldap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-manual | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-mysql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-odbc | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::as | php-pgsql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-devel | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-imap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-ldap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-manual | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-mysql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-odbc | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::aw | php-pgsql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-devel | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-imap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-ldap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-manual | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-mysql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-odbc | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::es | php-pgsql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-devel | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-imap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-ldap | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-manual | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-mysql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-odbc | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:2.1::ws | php-pgsql | 0 | 0:4.1.2-2.17 |
| Red Hat:enterprise_linux:3::as | php | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-debuginfo | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-devel | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-imap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-ldap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-mysql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-odbc | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::as | php-pgsql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-debuginfo | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-devel | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-imap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-ldap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-mysql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-odbc | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::desktop | php-pgsql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-debuginfo | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-devel | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-imap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-ldap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-mysql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-odbc | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::es | php-pgsql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-debuginfo | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-devel | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-imap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-ldap | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-mysql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-odbc | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:3::ws | php-pgsql | 0 | 0:4.3.2-40.ent |
| Red Hat:enterprise_linux:4::as | php | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-debuginfo | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-devel | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-domxml | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-gd | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-imap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-ldap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-mbstring | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-mysql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-ncurses | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-odbc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-pear | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-pgsql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-snmp | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::as | php-xmlrpc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-debuginfo | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-devel | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-domxml | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-gd | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-imap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-ldap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-mbstring | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-mysql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-ncurses | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-odbc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-pear | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-pgsql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-snmp | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::desktop | php-xmlrpc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-debuginfo | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-devel | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-domxml | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-gd | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-imap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-ldap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-mbstring | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-mysql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-ncurses | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-odbc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-pear | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-pgsql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-snmp | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::es | php-xmlrpc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-debuginfo | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-devel | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-domxml | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-gd | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-imap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-ldap | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-mbstring | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-mysql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-ncurses | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-odbc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-pear | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-pgsql | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-snmp | 0 | 0:4.3.9-3.22.4 |
| Red Hat:enterprise_linux:4::ws | php-xmlrpc | 0 | 0:4.3.9-3.22.4 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-devel | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-imap | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-ldap | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-manual | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-mysql | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-odbc | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-pgsql | 0 | 0:4.1.2-15 |
| Red Hat:rhel_stronghold:4.0 | stronghold-php-snmp | 0 | 0:4.1.2-15 |
Related vulnerabilities
- CVE-2007-1777 Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote… Also affects php4
- CVE-2007-0908 The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5… Also affects php4
- CVE-2005-1921 Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc)… Also affects php4
- CVE-2007-3806 The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of… Also affects php4
- CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php5
- CVE-2007-1399 Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as… Also affects php5
- CVE-2007-1376 The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not… Also affects php5
- CVE-2012-0830 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote… Also affects php5