CVE-2007-1884: Medium severity PHP PHP vulnerability

Published Apr 6, 2007

Updated

Multiple integer signedness errors in the printf function family in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on 64 bit machines allow context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers that arise in the phpformattedprint function because of 64 to 32 bit truncation, and bypass a check for the maximum allowable value; and (2) a width and precision of -1, which make it possible for the phpsprintfappendstring function to place an internal buffer at an arbitrary memory location.

Affected Software

77 affected components

PHP PHP=4.3.9

PHP PHP=4.0-beta1

PHP PHP=4.0-beta4

PHP PHP=4.2.0

PHP PHP=4.4.4

PHP PHP=4.1.0

PHP PHP=4.3.4

PHP PHP=4.0.4

PHP PHP=4.3.0

PHP PHP=4.0.5

PHP PHP=4.3.6

PHP PHP=4.0.7-rc2

PHP PHP=4.3.7

PHP PHP=4.0.7-rc1

PHP PHP=4.2.2

PHP PHP=4.4.2

PHP PHP=4.0-rc1

PHP PHP=4.3.2

PHP PHP=4.3.11

PHP PHP=4.0.0

PHP PHP=4.0.3-patch1

PHP PHP=4.0.7

PHP PHP=4.0.2

PHP PHP=4.3.3

PHP PHP=4.1.1

PHP PHP=4.4.3

PHP PHP=4.2.3

PHP PHP=4.0.1-patch1

PHP PHP=4.0

PHP PHP=4.0-beta2

PHP PHP=4.0.1-patch2

PHP PHP=4.0.6

PHP PHP=4.1.2

PHP PHP=4.0.7-rc3

PHP PHP=4.0-rc2

PHP PHP=4.3.1

PHP PHP=4.0-beta_4_patch1

PHP PHP=4.4.0

PHP PHP=4.3.10

PHP PHP=4.2.1

PHP PHP=4.0.4-patch1

PHP PHP=4.0.1

PHP PHP=4.2

PHP PHP=4.4.1

PHP PHP=4.0-beta3

PHP PHP=4.0.3

PHP PHP=4.3.8

PHP PHP=4.3.5

Apple iOS and macOS

Apple Mac OS X Server=10.4.9

Linux Linux kernel

Microsoft Windows Vista

Microsoft Windows XP

PHP PHP=5.0-rc1

PHP PHP=5.0-rc2

PHP PHP=5.0-rc3

PHP PHP=5.0.0

PHP PHP=5.0.0-beta1

PHP PHP=5.0.0-beta2

PHP PHP=5.0.0-beta3

PHP PHP=5.0.0-beta4

PHP PHP=5.0.0-rc1

PHP PHP=5.0.0-rc2

PHP PHP=5.0.0-rc3

PHP PHP=5.0.1

PHP PHP=5.0.2

PHP PHP=5.0.3

PHP PHP=5.0.4

PHP PHP=5.0.5

PHP PHP=5.1.0

PHP PHP=5.1.1

PHP PHP=5.1.2

PHP PHP=5.1.3

PHP PHP=5.1.4

PHP PHP=5.1.5

PHP PHP=5.1.6

PHP PHP=5.2.0

Remediation

Patch Available

http://www.php.net/releases/5_2_1.php

Event History

Apr 6, 2007

CVE Published

01:19 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1884?

CVE-2007-1884 has a high severity rating due to the potential for arbitrary code execution on vulnerable PHP versions.

How do I fix CVE-2007-1884?

To fix CVE-2007-1884, upgrade PHP to version 4.4.5 or later or to version 5.2.1 or later.

Which PHP versions are affected by CVE-2007-1884?

CVE-2007-1884 affects PHP versions 4 before 4.4.5 and PHP 5 before 5.2.1.

What types of attacks are possible with CVE-2007-1884?

CVE-2007-1884 allows attackers to execute arbitrary code due to integer signedness errors in the printf function family.

On which platforms does CVE-2007-1884 pose a risk?

CVE-2007-1884 poses a risk primarily on 64-bit machines running vulnerable versions of PHP.