CVE-2007-1581: Code Injection

Published Mar 21, 2007

Updated

The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hashupdatefile function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.

Affected Software

33 affected components

PHP PHP=5.2.9

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=5.3.1

PHP PHP=5.1.1

PHP PHP=5.1.6

PHP PHP=5.0-rc1

PHP PHP=5.2.7

PHP PHP=5.2.2

PHP PHP=5.0.5

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=5.2.5

PHP PHP=5.0.4

PHP PHP=5.2.12

PHP PHP=5.0-rc3

PHP PHP=5.2.11

PHP PHP=5.2.6

PHP PHP=5.3.0

PHP PHP=5.2.3

PHP PHP=5.0.3

PHP PHP=5.1.0

PHP PHP=5.2.13

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=5.2.4

PHP PHP=5.3.2

PHP PHP=5.1.3

PHP PHP=5.2.10

PHP PHP=5.0.2

PHP PHP=5.2.1

PHP PHP=5.0.0

PHP PHP=5.2.8

Event History

Mar 21, 2007

CVE Published

11:19 PM

Mar 22, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1581?

CVE-2007-1581 has a high severity rating due to its potential to allow attackers to execute arbitrary code.

How do I fix CVE-2007-1581?

Fixing CVE-2007-1581 involves upgrading PHP to a version later than 5.2.1 that addresses this vulnerability.

What versions of PHP are affected by CVE-2007-1581?

CVE-2007-1581 affects PHP versions 5.0.0 through 5.2.1.

Can CVE-2007-1581 be exploited remotely?

Yes, CVE-2007-1581 can be exploited remotely by context-dependent attackers.

What are the potential consequences of CVE-2007-1581?

The consequences of CVE-2007-1581 include the ability for attackers to disrupt services or execute malicious code on affected systems.