CVE-2007-0908: Input Validation
Published Feb 13, 2007
·Updated
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the keylength variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
Affected Software
16 affected components
PHP PHP>=4.0.0<4.4.5
PHP PHP>=5.0.0<5.2.1
PHP PHP=4.0
PHP PHP=4.0-beta_4_patch1
PHP PHP=4.0-beta1
PHP PHP=4.0-beta2
PHP PHP=4.0-beta3
PHP PHP=4.0-beta4
PHP PHP=4.0-rc1
PHP PHP=4.0-rc2
Ubuntu Linux=5.10
Ubuntu Linux=6.06
Ubuntu Linux=6.10
Ubuntu=6.06
Ubuntu=6.10
Ubuntu=5.10
Remediation
Patch Available
Event History
Feb 13, 2007
CVE Published
11:28 PM
Feb 14, 2007
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-0908?
CVE-2007-0908 has been classified as a vulnerability that can lead to information disclosure.
2
How do I fix CVE-2007-0908?
To resolve CVE-2007-0908, upgrade PHP to version 5.2.1 or later, or 4.4.5 or later.
3
Which versions of PHP are affected by CVE-2007-0908?
CVE-2007-0908 affects PHP versions 4.0 through 4.4.4 and 5.0 through 5.2.0.
4
What types of attacks can exploit CVE-2007-0908?
Attackers can exploit CVE-2007-0908 to read sensitive stack memory.
5
Is CVE-2007-0908 related to WDDX functionality in PHP?
Yes, CVE-2007-0908 specifically involves a vulnerability in the WDDX deserializer in PHP.