fkie_cve-2007-1900
Vulnerability from fkie_nvd
Published
2007-04-10 18:19
Modified
2025-04-09 00:30
Severity ?
Summary
CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.
References
cve@mitre.orghttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
cve@mitre.orghttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
cve@mitre.orghttp://secunia.com/advisories/24824Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/25056
cve@mitre.orghttp://secunia.com/advisories/25057
cve@mitre.orghttp://secunia.com/advisories/25062
cve@mitre.orghttp://secunia.com/advisories/25445
cve@mitre.orghttp://secunia.com/advisories/25535
cve@mitre.orghttp://secunia.com/advisories/26231
cve@mitre.orghttp://secunia.com/advisories/27037
cve@mitre.orghttp://secunia.com/advisories/27102
cve@mitre.orghttp://secunia.com/advisories/27110
cve@mitre.orghttp://security.gentoo.org/glsa/glsa-200705-19.xml
cve@mitre.orghttp://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863
cve@mitre.orghttp://www.debian.org/security/2007/dsa-1283
cve@mitre.orghttp://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
cve@mitre.orghttp://www.novell.com/linux/security/advisories/2007_32_php.html
cve@mitre.orghttp://www.osvdb.org/33962
cve@mitre.orghttp://www.php-security.org/MOPB/PMOPB-45-2007.htmlVendor Advisory
cve@mitre.orghttp://www.php.net/releases/5_2_3.php
cve@mitre.orghttp://www.securityfocus.com/bid/23359
cve@mitre.orghttp://www.trustix.org/errata/2007/0023/
cve@mitre.orghttp://www.ubuntu.com/usn/usn-455-1
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/2016
cve@mitre.orghttp://www.vupen.com/english/advisories/2007/3386
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/33510
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html
af854a3a-2127-422b-91ae-364da2661108http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
af854a3a-2127-422b-91ae-364da2661108http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/24824Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25056
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25057
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25062
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25445
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/25535
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/26231
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27037
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27102
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/27110
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-200705-19.xml
af854a3a-2127-422b-91ae-364da2661108http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2007/dsa-1283
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
af854a3a-2127-422b-91ae-364da2661108http://www.novell.com/linux/security/advisories/2007_32_php.html
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/33962
af854a3a-2127-422b-91ae-364da2661108http://www.php-security.org/MOPB/PMOPB-45-2007.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.php.net/releases/5_2_3.php
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/23359
af854a3a-2127-422b-91ae-364da2661108http://www.trustix.org/errata/2007/0023/
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-455-1
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/2016
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2007/3386
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/33510
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html
Impacted products
Vendor Product Version
php php 5.2.0
php php 5.2.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD02D837-FD28-4E0F-93F8-25E8D1C84A99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:5.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "88358D1E-BE6F-4CE3-A522-83D1FA4739E3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a \u0027\\n\u0027 character, which causes a regular expression to ignore the subsequent part of the address string."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyecci\u00f3n CRLF (retorno de carro y nueva l\u00ednea) en el filtro FILTER_VALIDATE_EMAIL en ext/filter de PHP 5.2.0 y 5.2.1 permite a atacantes locales o remotos dependiendo del contexto inyectar cabeceras de correo electr\u00f3nico de su elecci\u00f3n mediante una direcci\u00f3n de correo con un car\u00e1cter \u0027\\n\u0027, lo cual provoca que una expresi\u00f3n regular ignore la correspondiente parte de la cadena de direcci\u00f3n."
    }
  ],
  "id": "CVE-2007-1900",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2007-04-10T18:19:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/24824"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25056"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25057"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25062"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25445"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/25535"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/26231"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27037"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27102"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/27110"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200705-19.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.482863"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2007/dsa-1283"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2007_32_php.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/33962"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.php-security.org/MOPB/PMOPB-45-2007.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.php.net/releases/5_2_3.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/23359"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.trustix.org/errata/2007/0023/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-455-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/2016"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2007/3386"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33510"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/24824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25056"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25057"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25062"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25445"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/25535"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/26231"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27037"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27102"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/27110"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200705-19.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2007\u0026m=slackware-security.482863"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2007/dsa-1283"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2007_32_php.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/33962"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.php-security.org/MOPB/PMOPB-45-2007.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.php.net/releases/5_2_3.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/23359"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.trustix.org/errata/2007/0023/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-455-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/2016"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2007/3386"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33510"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Not vulnerable. The filter extension was not shipped in the versions of PHP supplied for Red Hat Enterprise Linux 2.1, 3, 4, 5, Stronghold 4.0, or\nRed Hat Application Stack 1.\n",
      "lastModified": "2007-04-16T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.