CVE-2007-0906: Buffer Overflow

Published Feb 13, 2007

Updated

Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) strreplace, (7) mail, (8) ibasedeleteuser, (9) ibaseadduser, and (10) ibasemodifyuser functions. NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885). NOTE: as of 20070411, vector (3) might involve the imapmailcompose function (CVE-2007-1825).

Affected Software

77 affected components

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=3.0.8

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=3.0.6

PHP PHP=4.0.3-patch1

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=4.4.3

PHP PHP=5.0.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=3.0.18

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=3.0.12

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

Trustix Secure Linux=3.0

Trustix Secure Linux=2.2

Remediation

Patch Available

http://www.securityfocus.com/bid/22496

Event History

Feb 13, 2007

CVE Published

11:28 PM

Feb 14, 2007

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0906?

CVE-2007-0906 is classified with a moderate severity as it can lead to denial of service and potentially allow the execution of arbitrary code.

How do I fix CVE-2007-0906?

To fix CVE-2007-0906, upgrade PHP to version 5.2.1 or later, which addresses the buffer overflow vulnerabilities.

Which PHP versions are affected by CVE-2007-0906?

CVE-2007-0906 affects multiple PHP versions including 3.0, 4.0, and 5.1 series prior to 5.2.1.

What are the possible impacts of CVE-2007-0906?

The potential impacts of CVE-2007-0906 include denial of service and unauthorized execution of code on affected systems.

Is it safe to use PHP versions before 5.2.1 due to CVE-2007-0906?

Using PHP versions prior to 5.2.1 is not safe because they are vulnerable to the buffer overflow exploits outlined in CVE-2007-0906.