CVE-2007-4887

{"id": "CVE-2007-4887", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-09-14T00:17:00.000", "references": [{"url": "http://docs.info.apple.com/article.html?artnum=307562", "source": "cve@mitre.org"}, {"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501", "source": "cve@mitre.org"}, {"url": "http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27102", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27659", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28750", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/29420", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/30040", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3133", "source": "cve@mitre.org"}, {"url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0242", "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml", "source": "cve@mitre.org"}, {"url": "http://www.php.net/ChangeLog-5.php#5.2.5", "source": "cve@mitre.org"}, {"url": "http://www.php.net/releases/5_2_5.php", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/478985/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/478988/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/491693/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26403", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/3825", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0398", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0924/references", "source": "cve@mitre.org"}, {"url": "https://issues.rpath.com/browse/RPL-1943", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5767", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The dl function in PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in the library parameter. NOTE: there are limited usage scenarios under which this would be a vulnerability."}, {"lang": "es", "value": "La funci\u00f3n dl en PHP 5.2.4 y versiones anteriores permite a atacantes locales o remotos dependientes del contexto provocar una denegaci\u00f3n de servicio (ca\u00edda de aplicaci\u00f3n) mediante una cadena larga en el par\u00e1metro library.\r\nNOTA. Existen escenarios de uso limitado bajo los cuales esto ser\u00eda una vulnerabilidad."}], "lastModified": "2018-10-15T21:38:37.830", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5B6B1C7-B7B8-495E-9FE5-FF39718DC64E", "versionEndIncluding": "5.2.4"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Because the argument passed to the dl() function are always under the control of the author, Mandriva does not consider this a security issue.", "lastModified": "2007-09-18T00:00:00", "organization": "Mandriva"}, {"comment": "The argument passed to the dl() function must always be under the control of the script author. We therefore do not consider this to be a security issue.\n", "lastModified": "2007-09-14T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}