// For flags

CVE-2007-1286

PHP 4 unserialize() ZVAL Reference Counter Overflow (Cookie)

Severity Score

6.8
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter.

Desbordamiento de entero en PHP 4.4.4 y anteriores permiten a atacantes dependientes de contexto ejecutar código de su elección mediante el paso de una cadena larga a la función unserialize, lo cual provoca el desbordamiento en el contador de referencias ZVAL.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-03-01 First Exploit
  • 2007-03-06 CVE Reserved
  • 2007-03-06 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-09-15 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
References (38)
URL Tag Source
http://secunia.com/advisories/24419 Third Party Advisory
http://secunia.com/advisories/24606 Third Party Advisory
http://secunia.com/advisories/24910 Third Party Advisory
http://secunia.com/advisories/24924 Third Party Advisory
http://secunia.com/advisories/24941 Third Party Advisory
http://secunia.com/advisories/24945 Third Party Advisory
http://secunia.com/advisories/25025 Third Party Advisory
http://secunia.com/advisories/25062 Third Party Advisory
http://secunia.com/advisories/25423 Third Party Advisory
http://secunia.com/advisories/25445 Third Party Advisory
http://secunia.com/advisories/25850 Third Party Advisory
http://www.osvdb.org/32771 Vdb Entry
http://www.securityfocus.com/archive/1/466166/100/0/threaded Mailing List
http://www.securityfocus.com/bid/22765 Vdb Entry
http://www.vupen.com/english/advisories/2007/1991 Vdb Entry
http://www.vupen.com/english/advisories/2007/2374 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/32796 Vdb Entry
https://issues.rpath.com/browse/RPL-1268 X_refsource_confirm
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11575 Signature
URL Date SRC
https://www.exploit-db.com/exploits/3396 2007-03-02
https://www.exploit-db.com/exploits/16310 2010-09-20
https://www.exploit-db.com/exploits/9939 2007-03-01
http://www.php-security.org/MOPB/MOPB-04-2007.html 2024-08-07
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/php/php_unserialize_zval_cookie.rb 2007-03-04
URL Date SRC
URL Date SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 2018-10-16
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 2018-10-16
http://rhn.redhat.com/errata/RHSA-2007-0154.html 2018-10-16
http://rhn.redhat.com/errata/RHSA-2007-0155.html 2018-10-16
http://rhn.redhat.com/errata/RHSA-2007-0163.html 2018-10-16
http://security.gentoo.org/glsa/glsa-200703-21.xml 2018-10-16
http://security.gentoo.org/glsa/glsa-200705-19.xml 2018-10-16
http://www.debian.org/security/2007/dsa-1282 2018-10-16
http://www.debian.org/security/2007/dsa-1283 2018-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 2018-10-16
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 2018-10-16
http://www.trustix.org/errata/2007/0009 2018-10-16
https://access.redhat.com/security/cve/CVE-2007-1286 2007-04-20
https://bugzilla.redhat.com/show_bug.cgi?id=1618297 2007-04-20
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 <= 4.4.4
Search vendor "Php" for product "Php" and version " <= 4.4.4"
-
Affected