Double free vulnerability in the session extension in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to execute arbitrary code via illegal characters in a session identifier, which is rejected by an internal session storage module, which calls the session identifier generator with an improper environment, leading to code execution when the generator is interrupted, as demonstrated by triggering a memory limit violation or certain PHP errors.

This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code.

CVE-2007-1380, CVE-2007-0988, CVE-2007-1375, CVE-2007-1454 CVE-2007-1453, CVE-2007-1521, CVE-2007-1522, CVE-2007-1376 CVE-2007-1583, CVE-2007-1460, CVE-2007-1461, CVE-2007-1484 CVE-2007-1700, CVE-2007-1717, CVE-2007-1718, CVE-2007-1001 CVE-2007-1824, CVE-2007-1889, CVE-2007-1900

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

According to its banner, the version of PHP installed on the remote host is older than 4.4.7 / 5.2.2.  Such versions may be affected by several issues, including buffer overflows in the GD library.

ID	Name	Product	Family	Severity
27150	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289)	Nessus	SuSE Local Security Checks	high
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
25159	PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2007-1522

critical

Tenable Plugins

high

high

high