PT-2007-4148 · Php · Php

Published 2007-05-24 · Updated 2018-10-30 · CVE-2007-2844

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PHP versions 4.x through 5.2.0

Description The issue arises from the lack of thread safety in libc crypt function calls on multi-threaded systems, leading to race conditions. This allows remote attackers to overwrite internal program memory and potentially gain system access.

Recommendations For PHP versions 4.x through 5.2.0, update to version 5.2.1 or later to ensure thread safety for libc crypt function calls and prevent potential system access by remote attackers.

Fix

Related Identifiers

CVE-2007-2844

Affected Products

Php

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-2844 · Security Note
• http://secunia.com/advisories/25434 · Note
• http://securityfocus.com/bid/24109 · Note
• http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html · Note
• http://osvdb.org/36088 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2844 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34601 · Note