Vulnerabilities > CVE-2007-2844 - Unspecified vulnerability in PHP

CVSS 0.0 - NONE

Attack vector

UNKNOWN

Attack complexity

UNKNOWN

Privileges required

UNKNOWN

Confidentiality impact

UNKNOWN

Integrity impact

UNKNOWN

Availability impact

UNKNOWN

php

nessus

NVD

Published: 2007-05-24

Updated: 2024-11-21

Summary

PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP 4.3.9 PHP PHP 4.0 PHP PHP 5.1.5 PHP PHP 5.1.2 PHP PHP 4.2.0 PHP PHP 5.1.1 PHP PHP 4.4.4 PHP PHP 5.0.0 PHP PHP 4.1.0 PHP PHP 5.1.6 PHP PHP 4.3.4 PHP PHP 4.0.4 PHP PHP 4.3.0 PHP PHP 4.0.5 PHP PHP 5.0 PHP PHP 5.0.5 PHP PHP 4.3.6 PHP PHP 5.0.1 PHP PHP 5.1.4 PHP PHP 4.0.7 PHP PHP 4.3.7 PHP PHP 5.0.4 PHP PHP 4.2.2 PHP PHP 4.4.2 PHP PHP 4.3.2 PHP PHP 4.3.11 PHP PHP 4.0.0 PHP PHP 4.0.3 PHP PHP 4.0.2 PHP PHP 4.3.3 PHP PHP 4.1.1 PHP PHP 4.4.3 PHP PHP 5.0.3 PHP PHP 4.2.3 PHP PHP 5.1.0 PHP PHP 4.4.5 PHP PHP 4.0.1 PHP PHP 4.0.6 PHP PHP 5.2.0 PHP PHP 4.1.2 PHP PHP 4.3.1 PHP PHP 5.1.3 PHP PHP 4.4.0 PHP PHP 4.3.10 PHP PHP 4.2.1 PHP PHP 5.0.2 PHP PHP 4.4.6 PHP PHP 4.4.1 PHP PHP 4.3.8 PHP PHP 4.3.5	73

Nessus

NASL family	CGI abuses
NASL id	PHP_5_2_0.NASL
description	According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2. Such versions may be affected by several buffer overflows. To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as
last seen	2020-06-01
modified	2020-06-02
plugin id	31649
published	2008-03-25
reporter	This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/31649
title	PHP 5.x < 5.2 Multiple Vulnerabilities

Statements

contributor	Mark J Cox
lastmodified	2007-05-29
organization	Red Hat
statement	Not vulnerable. PHP is not built or supported in a multi-threaded environment in the packages distributed in Red Hat Enterprise Linux or Application Stack.

Summary

Vulnerable Configurations

Nessus

Statements

References