vulnwire
9.8crit

CVE-2007-1383in critical feed1 exploit

Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflow…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
15.4%
percentile 97%
Public exploits
1
Exploit-DB

Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.

CISA SSVC assessment

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
19 mo ago

Exploit prediction (EPSS)

15.40% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

Exploits and detections

  • EDB-3394 PHP 4 - Userland ZVAL Reference Counter Overflow (PoC) · dos · 2007-03-01

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds
PHP (RSS, critical only)

References

  • secunia.com /advisories/25056 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/24606 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • php-security.org /MOPB/MOPB-01-2007.html · x_refsource_MISC, x_transferred
  • osvdb.org /32770 · vdb-entry, x_refsource_OSVDB, x_transferred
  • security.gentoo.org /glsa/glsa-200703-21.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • novell.com /linux/security/advisories/2007_32_php.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securityfocus.com /bid/22765 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.