CVE-2007-1583: Medium severity PHP PHP vulnerability

Published Mar 21, 2007

Updated

The mbparsestr function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 sets the internal registerglobals flag and does not disable it in certain cases when a script terminates, which allows remote attackers to invoke available PHP scripts with registerglobals functionality that is not detectable by these scripts, as demonstrated by forcing a memorylimit violation.

Affected Software

75 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Event History

Mar 21, 2007

CVE Published

11:19 PM

Mar 22, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1583?

The severity of CVE-2007-1583 is considered to be high due to the risk of remote code execution.

How do I fix CVE-2007-1583?

To fix CVE-2007-1583, upgrade to a patched version of PHP that addresses this vulnerability.

Which versions of PHP are affected by CVE-2007-1583?

CVE-2007-1583 affects PHP versions 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1.

What is the impact of exploiting CVE-2007-1583?

Exploiting CVE-2007-1583 can allow remote attackers to enable the register_globals feature, leading to potential data leakage or code injection.

Is CVE-2007-1583 still a risk for modern PHP applications?

Yes, CVE-2007-1583 remains a risk if legacy versions of PHP vulnerable to this issue are still in use.