CVE-2007-1461: High severity PHP PHP vulnerability

Q: What is the severity of CVE-2007-1461?

CVE-2007-1461 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive files.

Q: How do I fix CVE-2007-1461?

To fix CVE-2007-1461, upgrade to PHP version 4.4.7 or later, or 5.2.2 or later which include the necessary security checks.

Q: What types of attacks can exploit CVE-2007-1461?

CVE-2007-1461 can be exploited by remote attackers to read sensitive bzip2 archives located outside the intended directories.

Q: Which PHP versions are affected by CVE-2007-1461?

CVE-2007-1461 affects PHP versions prior to 4.4.7 and 5.x prior to 5.2.2.

Q: Is there a workaround for CVE-2007-1461?

There is no reliable workaround for CVE-2007-1461; upgrading to a fixed version is the recommended approach.

Published Mar 14, 2007

Updated

The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or openbasedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories.

Affected Software

76 affected components

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.1.1

PHP PHP=5.1.6

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.0.4

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.2.0

PHP PHP=5.1.3

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0

PHP PHP=4.3.9

PHP PHP=3.0

PHP PHP=4.0-beta1

PHP PHP=3.0.5

PHP PHP=3.0.11

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=3.0.1

PHP PHP=3.0.2

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=3.0.8

PHP PHP=4.3.6

PHP PHP=3.0.13

PHP PHP<=4.4.6

PHP PHP=4.3.7

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=3.0.7

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=3.0.6

PHP PHP=3.0.17

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=2.0

PHP PHP=4.1.1

PHP PHP=3.0.15

PHP PHP=3.0.16

PHP PHP=4.4.3

PHP PHP=3.0.10

PHP PHP=3.0.4

PHP PHP=4.2.3

PHP PHP=4.4.5

PHP PHP=4.0-beta2

PHP PHP=2.0b10

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.3.1

PHP PHP=3.0.18

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.1

PHP PHP=1.0

PHP PHP=3.0.12

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=3.0.14

PHP PHP=3.0.9

PHP PHP=3.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

Event History

Mar 14, 2007

CVE Published

06:19 PM

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1461?

CVE-2007-1461 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive files.

How do I fix CVE-2007-1461?

To fix CVE-2007-1461, upgrade to PHP version 4.4.7 or later, or 5.2.2 or later which include the necessary security checks.

What types of attacks can exploit CVE-2007-1461?