CVE-2007-1286: Integer Overflow
Published Mar 6, 2007
·Updated
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Affected Software
1 affected component
PHP PHP<=4.4.4
Remediation
Patch Available
Event History
Mar 6, 2007
CVE Published
08:19 PM
Mar 7, 2007
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-1286?
CVE-2007-1286 has a high severity due to the potential for remote code execution.
2
How do I fix CVE-2007-1286?
To fix CVE-2007-1286, upgrade PHP to version 4.4.5 or later.
3
Which versions of PHP are affected by CVE-2007-1286?
CVE-2007-1286 affects PHP versions 4.4.4 and earlier.
4
What types of attacks are possible with CVE-2007-1286?
CVE-2007-1286 allows remote attackers to execute arbitrary code through crafted input.
5
Is there a workaround for CVE-2007-1286?
A practical workaround for CVE-2007-1286 is to avoid using the unserialize function with untrusted input.