CVE-2007-4840: Input Validation
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the outcharset parameter to the iconv function; or a long string in the charset parameter to the (2) iconvmimedecodeheaders, (3) iconvmimedecode, or (4) iconvstrlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-4840?
CVE-2007-4840 is rated as a moderate severity vulnerability that can lead to denial of service.
How do I fix CVE-2007-4840?
To fix CVE-2007-4840, upgrade PHP to a version later than 5.2.4.
What type of attack does CVE-2007-4840 facilitate?
CVE-2007-4840 can facilitate denial of service attacks through excessively long strings in certain parameters.
Which versions of PHP are affected by CVE-2007-4840?
CVE-2007-4840 affects PHP versions up to and including 5.2.4.
What functions are involved in the CVE-2007-4840 vulnerability?
The functions involved in CVE-2007-4840 include iconv, iconv_mime_decode_headers, and iconv_mime_decode.