CVE-2007-4783: Input Validation
First published: Mon Sep 10 2007(Updated: )
The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP | <=5.2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://issues.rpath.com/browse/RPL-1943
- http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
- http://secunia.com/advisories/27102
- http://secunia.com/advisories/27659
- http://securityreason.com/securityalert/3115
- http://secunia.com/advisories/30040
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
- http://osvdb.org/38917
- http://www.securityfocus.com/archive/1/491693/100/0/threaded
- http://www.securityfocus.com/archive/1/478637/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-4783?
CVE-2007-4783 has a moderate severity level due to its potential to cause a denial of service.
How do I fix CVE-2007-4783?
To fix CVE-2007-4783, upgrade PHP to version 5.2.5 or later, which addresses the vulnerability.
What types of attacks are possible with CVE-2007-4783?
CVE-2007-4783 can be exploited to cause application crashes or temporary hangs through the use of long strings in the charset and str parameters.
Which versions of PHP are affected by CVE-2007-4783?
CVE-2007-4783 affects PHP versions up to and including 5.2.4.
Is the CVE-2007-4783 vulnerability a remote or local attack vector?
CVE-2007-4783 is primarily a local attack vector, but it can also be exploited by context-dependent attackers remotely.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/php
- canonical/php
- version/php/5.2.4