CVE-2007-2872: Integer Overflow
Published Jun 4, 2007
·Updated
Multiple integer overflows in the chunksplit function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
Affected Software
17 affected components
PHP PHP=5.1.5
PHP PHP=5.1.2
PHP PHP=5.1.1
PHP PHP=5.1.6
PHP PHP=5.2.2
PHP PHP=5.0.5
PHP PHP=5.0.1
PHP PHP=5.1.4
PHP PHP=5.0.4
PHP PHP<=4.4.7
PHP PHP=5.0.3
PHP PHP=5.1.0
PHP PHP=5.2.0
PHP PHP=5.1.3
PHP PHP=5.0.2
PHP PHP=5.2.1
PHP PHP=5.0.0
Remediation
Patch Available
Event History
Jun 4, 2007
CVE Published
05:30 PM
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2872?
CVE-2007-2872 is classified as a security vulnerability that can lead to denial of service or remote code execution.
2
How do I fix CVE-2007-2872?
To fix CVE-2007-2872, upgrade to PHP version 5.2.3 or later and eliminate any vulnerable versions.
3
What software is affected by CVE-2007-2872?
CVE-2007-2872 affects PHP versions before 5.2.3 and versions 4 up to 4.4.7.
4
Can CVE-2007-2872 be exploited remotely?
Yes, CVE-2007-2872 can be exploited remotely, allowing attackers to execute arbitrary code.
5
What are the specific functions involved in CVE-2007-2872?
The vulnerability in CVE-2007-2872 is found in the chunk_split function's handling of arguments.