Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

According to its banner, the version of PHP installed on the remote host is older than 4.4.5.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1375     Stefan Esser discovered that an integer overflow in the     substr_compare() function allows information disclosure     of heap memory.

  - CVE-2007-1376     Stefan Esser discovered that insufficient validation of     shared memory functions allows the disclosure of heap     memory.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1453     Stefan Esser discovered that the filtering framework     performs insufficient input validation, which allows the     execution of arbitrary code through a buffer underflow.

  - CVE-2007-1454     Stefan Esser discovered that the filtering framework can     be bypassed with a special whitespace character.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1583     Stefan Esser discovered that a programming error in the     mb_parse_str() function allows the activation of     'register_globals'.

  - CVE-2007-1700     Stefan Esser discovered that the session extension     incorrectly maintains the reference count of session     variables, which allows the execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

  - CVE-2007-1824     Stefan Esser discovered an off-by-one error in the     filtering framework, which allows the execution of     arbitrary code.

  - CVE-2007-1887     Stefan Esser discovered that a buffer overflow in the     sqlite extension allows the execution of arbitrary code.

  - CVE-2007-1889     Stefan Esser discovered that the PHP memory manager     performs an incorrect type cast, which allows the     execution of arbitrary code through buffer overflows.

  - CVE-2007-1900     Stefan Esser discovered that incorrect validation in the     email filter extension allows the injection of mail     headers.

The oldstable distribution (sarge) doesn't include php5.

The remote host is running PHP less than 5.2.0.  This version is vulnerable to around 180 bugs.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	Name	Product	Family	Published	Updated	Severity
25099	Debian DSA-1282-1 : php4 - several vulnerabilities	Nessus	Debian Local Security Checks	4/30/2007	1/4/2021	high
24906	PHP < 4.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	4/2/2007	11/22/2024	high
25100	Debian DSA-1283-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	4/30/2007	1/4/2021	high
3857	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2/9/2007	3/6/2019	medium
801112	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

Detections

Analytics

Plugins Search

high

high

high

medium

high