CVE-2007-1886: Integer Overflow

Published Apr 6, 2007

Updated

Integer overflow in the strreplace function in PHP 4.4.5 and PHP 5.2.1 allows context-dependent attackers to have an unknown impact via a single character search string in conjunction with a single character replacement string, which causes an "off by one overflow."

Affected Software

2 affected components

PHP PHP=4.4.5

PHP PHP=5.2.1

Remediation

Patch Available

http://www.php-security.org/MOPB/MOPB-39-2007.html

Event History

Apr 6, 2007

CVE Published

01:19 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1886?

CVE-2007-1886 is considered a medium severity vulnerability due to the potential for integer overflow leading to possible unauthorized actions.

How do I fix CVE-2007-1886?

To fix CVE-2007-1886, you should upgrade PHP to version 4.4.6 or later, or to version 5.2.2 or later.

What versions of PHP are affected by CVE-2007-1886?

CVE-2007-1886 specifically affects PHP versions 4.4.5 and 5.2.1.

What impact does CVE-2007-1886 have on my application?

CVE-2007-1886 can lead to unexpected behaviors or vulnerabilities in applications relying on the str_replace function, potentially allowing context-dependent attackers to exploit the overflow.

Is CVE-2007-1886 a common vulnerability?

CVE-2007-1886 is somewhat common due to the continued usage of the affected PHP versions in legacy applications.