1. CVE-Search
  2. CVE-2007-0911
ID CVE-2007-0911
Summary Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).
References
Vulnerable Configurations
  • cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*
CVSS
Base: 7.8 (as of 16-10-2018 - 16:35)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:C
refmap via4
bid 22505
bugtraq 20070209 PHP 5.2.1 crash bug
gentoo GLSA-200703-21
misc http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.36&r2=1.445.2.14.2.37
mlist
  • [php-dev] 20070209 PHP 5.2.1 crashing Apache/IIS...
  • [php-dev] 20070210 Re: PHP 5.2.1 crashing Apache/IIS...
osvdb 33952
secunia
  • 24514
  • 24606
suse SUSE-SA:2007:020
statements via4
contributor Mark J Cox
lastmodified 2007-02-16
organization Red Hat
statement Not vulnerable. This flaw is a regression of the fix for CVE-2007-0906 affecting PHP version 5.2.1 only which results in any use of str_replace() causing a crash regardless of user input. These issues did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 2.1, 3, or 4.
Last major update 16-10-2018 - 16:35
Published 13-02-2007 - 23:28
Last modified 16-10-2018 - 16:35
Back to Top