what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 1 - 6 of 6 RSS Feed

CVE-2007-1864

Status Candidate

Overview

Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.

Related Files

Ubuntu Security Notice 485-1
Posted Jul 18, 2007
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 485-1 - It was discovered that the PHP xmlrpc extension did not correctly check heap memory allocation sizes. A remote attacker could send a specially crafted request to a PHP application using xmlrpc and execute arbitrary code as the Apache user. Stefan Esser discovered a flaw in the random number initialization of the PHP SOAP extension. This could lead to remote attackers being able to predict certain elements of the authentication mechanism.

tags | advisory, remote, arbitrary, php
systems | linux, ubuntu
advisories | CVE-2007-1864, CVE-2007-2728
SHA-256 | 3b1aa1db8f86fd8720cd09c25870adcb7f21377c0979f21e48754ce40876a96b
Debian Linux Security Advisory 1331-1
Posted Jul 10, 2007
Authored by Debian | Site debian.org

Debian Security Advisory 1331-1 - Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. Stefan Esser discovered HTTP response splitting vulnerabilities in the session extension. This only affects Debian 3.1 (Sarge). Stefan Esser discovered that an integer overflow in memory allocation routines allows the bypass of memory limit restrictions. This only affects Debian 3.1 (Sarge) on 64 bit architectures. It was discovered that a buffer overflow in the xmlrpc extension allows the execution of arbitrary code.

tags | advisory, remote, web, overflow, arbitrary, php, vulnerability
systems | linux, debian
advisories | CVE-2006-0207, CVE-2006-4486, CVE-2007-1864
SHA-256 | 1fce4b0b46bc0da44b8af40e54073c49f088b0f0cecd1ec997ffa0a91147d009
Debian Linux Security Advisory 1330-1
Posted Jul 10, 2007
Authored by Debian | Site debian.org

Debian Security Advisory 1330-1 - Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. Stefan Esser discovered that a buffer overflow in the zip extension allows the execution of arbitrary code. It was discovered that a buffer overflow in the xmlrpc extension allows the execution of arbitrary code.

tags | advisory, remote, overflow, arbitrary, php, vulnerability
systems | linux, debian
advisories | CVE-2007-1864, CVE-2007-1399
SHA-256 | 2f61278426160afc3394bc0eabb02afcc1f4c2d9133820a6b516d03fd3299f52
Gentoo Linux Security Advisory 200705-19
Posted May 31, 2007
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200705-19 - Several vulnerabilities were found in PHP, most of them during the Month Of PHP Bugs (MOPB) by Stefan Esser. The most severe of these vulnerabilities are integer overflows in wbmp.c from the GD library and in the substr_compare() PHP 5 function. Ilia Alshanetsky also reported a buffer overflow in the make_http_soap_request() and in the user_filter_factory_create() functions, and Stanislav Malyshev discovered another buffer overflow in the bundled XMLRPC library. Additionally, the session_regenerate_id() and the array_user_key_compare() functions contain a double-free vulnerability. Finally, there exist implementation errors in the Zend engine, in the mb_parse_str(), the unserialize() and the mail() functions and other elements. Versions less than 5.2.2 are affected.

tags | advisory, overflow, php, vulnerability
systems | linux, gentoo
advisories | CVE-2007-1001, CVE-2007-1285, CVE-2007-1286, CVE-2007-1484, CVE-2007-1521, CVE-2007-1583, CVE-2007-1700, CVE-2007-1701, CVE-2007-1711, CVE-2007-1717, CVE-2007-1718, CVE-2007-1864, CVE-2007-1900, CVE-2007-2509, CVE-2007-2510, CVE-2007-2511
SHA-256 | 85b7223b6bfd70f54588716713c6a4f7ef1cdaf921d40a164c836fe16bbb3b6f
Mandriva Linux Security Advisory 2007.103
Posted May 12, 2007
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - Multiple vulnerabilities in PHP4 have been fixed.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2007-1864, CVE-2007-2509
SHA-256 | ae759429289c1a3693ebe71fa61005c7aa7fcbf3ea7221d2667bd23c8df1c652
Mandriva Linux Security Advisory 2007.102
Posted May 12, 2007
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - Multiple vulnerabilities in PHP have been fixed.

tags | advisory, php, vulnerability
systems | linux, mandriva
advisories | CVE-2007-1864, CVE-2007-2509, CVE-2007-2510, CVE-2007-2511
SHA-256 | 309a748bbde2fa997c8e6a8ce844c9b4e8862353547fad0c2c90deb5ea8933c6
Page 1 of 1
Back1Next

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    15 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close