CVE-2007-2844

PHP 4.x and 5.x < 5.2.1 - Remote Code Execution via Thread-Unsafe libc crypt Function

Title source: llm
STIX 2.1

Description

PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access.

References (5)

Core 5
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/25434
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/36088
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/34601
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/24109

Scores

EPSS 0.0095
EPSS Percentile 76.6%

Details

Status published
Products (36)
php/php 4.0 (8 CPE variants)
php/php 4.0.0
php/php 4.0.1 (3 CPE variants)
php/php 4.0.2
php/php 4.0.3 (2 CPE variants)
php/php 4.0.4 (2 CPE variants)
php/php 4.0.5
php/php 4.0.6
php/php 4.0.7 (4 CPE variants)
php/php 4.1.0
... and 26 more
Published May 24, 2007
Tracked Since Feb 18, 2026