CVE-2007-1399
NoneCVSS
—
EPSS
20.1%
Published
Mar 10, 2007
CISA due date
—
The record
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | php5 | 0 | 5.2.0-8+etch7 |
Related vulnerabilities
- CVE-2009-4017 PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files… Also affects php5
- CVE-2007-3806 The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of… Also affects php5
- CVE-2007-1777 Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote… Also affects php5
- CVE-2007-1376 The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not… Also affects php5
- CVE-2007-1286 Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to… Also affects php5