CVE-2007-4657: Buffer Overflow
Multiple integer overflows in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to obtain sensitive information (memory contents) or cause a denial of service (thread crash) via a large len value to the (1) strspn or (2) strcspn function, which triggers an out-of-bounds read. NOTE: this affects different product versions than CVE-2007-3996.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4657?
CVE-2007-4657 has been classified as a medium severity vulnerability due to its potential to cause denial of service and information leakage.
How do I fix CVE-2007-4657?
To fix CVE-2007-4657, upgrade PHP to version 4.4.8 or later, or to version 5.2.4 or later.
What software is affected by CVE-2007-4657?
CVE-2007-4657 affects PHP versions before 4.4.8 and 5.2.4, as well as specific versions of Debian and Ubuntu Linux.
What types of exploitations are possible with CVE-2007-4657?
CVE-2007-4657 can be exploited to obtain sensitive information through memory leaks or can lead to a denial of service by crashing the application.
Is CVE-2007-4657 still a concern for modern applications?
CVE-2007-4657 is less of a concern for modern applications using supported PHP versions, but users of outdated versions should be aware of this vulnerability.