PT-2007-4148 · Php · Php

Publicado 2007-05-24 · Atualizado 2018-10-30 · CVE-2007-2844

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 5.2.0

Description The issue arises from the lack of thread safety in libc crypt function calls on multi-threaded systems, leading to race conditions. This allows remote attackers to overwrite internal program memory and potentially gain system access.

Recommendations For PHP versions 4.x through 5.2.0, update to version 5.2.1 or later to ensure thread safety for libc crypt function calls and prevent potential system access by remote attackers.

Correção

Identificadores relacionados

CVE-2007-2844

Produtos afetados

Php

Referências · 7

• http://secunia.com/advisories/25434 · Nota
• http://securityfocus.com/bid/24109 · Nota
• http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html · Nota
• http://osvdb.org/36088 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2844 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2844 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34601 · Nota