CVE-2007-0908

PHP <5.2.1 & <4.4.5 - Info Disclosure

Title source: llm

Description

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Stefan Esser · phplocalmultiple

https://www.exploit-db.com/exploits/3414

View Code ZIP pw:eip

References (43)

[Broken Link] ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc

[Broken Link] http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html

[Broken Link] http://osvdb.org/32766

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2007-0089.html

[Third Party Advisory] http://secunia.com/advisories/24089

[Third Party Advisory] http://secunia.com/advisories/24195

[Third Party Advisory] http://secunia.com/advisories/24217

[Third Party Advisory] http://secunia.com/advisories/24236

[Third Party Advisory] http://secunia.com/advisories/24248

[Third Party Advisory] http://secunia.com/advisories/24284

[Third Party Advisory] http://secunia.com/advisories/24295

[Third Party Advisory] http://secunia.com/advisories/24322

[Third Party Advisory] http://secunia.com/advisories/24419

[Third Party Advisory] http://secunia.com/advisories/24421

[Third Party Advisory] http://secunia.com/advisories/24432

[Third Party Advisory] http://secunia.com/advisories/24514

[Third Party Advisory] http://secunia.com/advisories/24606

[Third Party Advisory] http://secunia.com/advisories/24642

[Third Party Advisory] http://security.gentoo.org/glsa/glsa-200703-21.xml

[Third Party Advisory] http://securityreason.com/securityalert/2321

... and 23 more

Scores

EPSS 0.1653

EPSS Percentile 94.9%

Details

CWE

CWE-20

Status published

Products (5)

canonical/ubuntu_linux 5.10

canonical/ubuntu_linux 6.06

canonical/ubuntu_linux 6.10

php/php 4.0 (8 CPE variants)

php/php 4.0.0 - 4.4.5

Published Feb 13, 2007

Tracked Since Feb 18, 2026