CVE-2007-1885

2007-04-0601:19:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

php

integer overflow

arbitrary code execution

cve-2007-1885

security vulnerability

nvd

7.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

88.0%

JSON

Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a single character search string in conjunction with a long replacement string, which overflows a 32 bit length counter. NOTE: this is probably the same issue as CVE-2007-0906.6.

CPENameOperatorVersion
php:phpphpeq4.3.9
php:phpphpeq5.1.5
php:phpphpeq5.1.2
php:phpphpeq4.2.0
php:phpphpeq5.1.1
php:phpphpeq4.4.4
php:phpphpeq5.0.0
php:phpphpeq4.1.0
php:phpphpeq5.1.6
php:phpphpeq4.3.4

CPE	Name	Operator	Version
php:php	php	eq	4.3.9
php:php	php	eq	5.1.5
php:php	php	eq	5.1.2
php:php	php	eq	4.2.0
php:php	php	eq	5.1.1
php:php	php	eq	4.4.4
php:php	php	eq	5.0.0
php:php	php	eq	4.1.0
php:php	php	eq	5.1.6
php:php	php	eq	4.3.4