CVE-2007-3998: Input Validation
Published Sep 4, 2007
·Updated
The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
Affected Software
8 affected components
PHP PHP>=4.0.0<4.4.8
PHP PHP>=5.0.0<5.2.4
Debian Debian Linux=3.1
Debian Debian Linux=4.0
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=7.10
Canonical Ubuntu Linux=6.10
Event History
Sep 4, 2007
CVE Published
06:17 PM
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-3998?
The severity of CVE-2007-3998 is considered moderate due to its potential to cause denial of service.
2
How do I fix CVE-2007-3998?
To fix CVE-2007-3998, upgrade PHP to version 4.4.8 or later, or PHP 5.2.4 or later.
3
What versions of PHP are affected by CVE-2007-3998?
CVE-2007-3998 affects PHP versions before 4.4.8 and 5.2.4.
4
Can CVE-2007-3998 be exploited remotely?
Yes, CVE-2007-3998 can be exploited remotely to cause denial of service.
5
What type of vulnerabilities does CVE-2007-3998 represent?
CVE-2007-3998 represents a denial of service vulnerability related to improper argument handling in the wordwrap function.