CVE-2007-1717: Medium severity PHP PHP vulnerability

Published Mar 28, 2007

Updated

The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0') byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages. NOTE: this issue might be security-relevant in cases when the trailing contents of e-mail messages are important, such as logging information or if the message is expected to be well-formed.

Affected Software

75 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=5.1.5

PHP PHP=5.1.2

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=5.1.1

PHP PHP=4.4.4

PHP PHP=5.0.0-beta1

PHP PHP=4.1.0

PHP PHP=5.1.6

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=5.0-rc1

PHP PHP=5.0.5

PHP PHP=4.3.6

PHP PHP=5.0.1

PHP PHP=5.1.4

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=5.0.4

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=5.0-rc3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=5.0.0-rc2

PHP PHP=5.0.3

PHP PHP=4.2.3

PHP PHP=5.1.0

PHP PHP=4.4.5

PHP PHP=4.0.1-patch1

PHP PHP=5.0.0-rc3

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=5.2.0

PHP PHP=5.0-rc2

PHP PHP=4.1.2

PHP PHP=5.0.0-beta3

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=5.1.3

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=5.0.0-rc1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=5.0.2

PHP PHP=4.4.6

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=5.2.1

PHP PHP=4.0.3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0

PHP PHP=4.3.8

PHP PHP=4.3.5

PHP PHP=5.0.0-beta2

Event History

Mar 28, 2007

CVE Published

12:19 AM

CVE Published

via MITRE·04:00 AM

Data Sourced

via MITRE·04:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1717?

CVE-2007-1717 is considered a moderate vulnerability due to its exploitation potential in email message delivery.

How do I fix CVE-2007-1717?

To fix CVE-2007-1717, upgrade to a PHP version that is higher than 5.2.1 or apply patches if available.

What software is affected by CVE-2007-1717?

CVE-2007-1717 affects PHP versions 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1.

Can CVE-2007-1717 lead to data loss?

Yes, CVE-2007-1717 can potentially lead to data loss by truncating email messages at the first ASCIIZ byte.

Is CVE-2007-1717 a common vulnerability in PHP?

Yes, CVE-2007-1717 is noted as a common vulnerability affecting multiple versions of PHP.