← back
CVE-2007-1286

CVE-2007-1286

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 40%
from disclosure to weapon0 days
Published on NVDMar 6
1st PoCMar 1
metasploitMar 4
exploitation probability
40%top 2% of all CVEs
observed exploitation
nono source reports it
3 public exploit(s)
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.
Affected products
n/a · n/a
public PoCs found — 3
exploitdbwww.exploit-db.com/exploits/3396unverifiedexploitdbwww.exploit-db.com/exploits/16310unverifiedexploitdbwww.exploit-db.com/exploits/9939unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137http://rhn.redhat.com/errata/RHSA-2007-0154.htmlhttp://rhn.redhat.com/errata/RHSA-2007-0155.htmlhttp://rhn.redhat.com/errata/RHSA-2007-0163.htmlhttp://secunia.com/advisories/24419http://secunia.com/advisories/24606http://secunia.com/advisories/24910http://secunia.com/advisories/24924http://secunia.com/advisories/24941http://secunia.com/advisories/24945http://secunia.com/advisories/25025