CVE-2007-4782: Code Injection
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "[1]e" value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4782?
CVE-2007-4782 is classified as a denial of service vulnerability that can lead to application crashes.
How do I fix CVE-2007-4782?
To fix CVE-2007-4782, upgrade PHP to version 5.2.4 or later.
What software is affected by CVE-2007-4782?
CVE-2007-4782 affects PHP versions before 5.2.4.
What actions can exploit CVE-2007-4782?
An attacker can exploit CVE-2007-4782 by providing long strings as parameters to the glob or fnmatch functions.
What are the potential impacts of CVE-2007-4782?
The potential impact of CVE-2007-4782 includes application crashes and service disruptions.