PT-2007-2878 · Php · Php

Stefan Esser · Publicado 2007-03-16 · Atualizado 2018-10-19 · CVE-2007-1484

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.2.1 PHP version 4.4.6 and earlier

Description The issue is related to the array user key compare function, which makes erroneous calls to zval dtor, leading to memory corruption. This allows local users to bypass safe mode and execute arbitrary code via a certain unset operation after array user key compare has been called.

Recommendations For PHP versions prior to 5.2.1, update to version 5.2.1 or later to resolve the issue. For PHP version 4.4.6 and earlier, consider upgrading to a newer version of PHP, as these versions are no longer supported. As a temporary workaround, consider restricting the use of the array user key compare function and the zval dtor function until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2007-1484

Produtos afetados

Php

Referências · 19

• 🔥 https://exploit-db.com/exploits/3499 · Exploit
• 🔥 http://php-security.org/MOPB/MOPB-24-2007.html · Exploit
• http://vupen.com/english/advisories/2007/2732 · Nota
• http://securityfocus.com/bid/25159 · Nota
• http://secunia.com/advisories/26235 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1484 · Nota de Segurança
• http://docs.info.apple.com/article.html?artnum=306172 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1484 · Nota
• http://security.gentoo.org/glsa/glsa-200705-19.xml · Aviso do Fabricante
• http://secunia.com/advisories/24542 · Nota
• http://securityfocus.com/bid/22990 · Nota
• http://ubuntu.com/usn/usn-455-1 · Aviso do Fabricante
• http://us2.php.net/releases/5_2_2.php · Nota
• http://secunia.com/advisories/25057 · Nota
• http://secunia.com/advisories/25056 · Nota