CVE-2007-6039

{"id": "CVE-2007-6039", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-11-20T19:46:00.000", "references": [{"url": "http://securityreason.com/securityalert/3365", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3366", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/483644/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/483648/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26426", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26428", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38442", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38443", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution."}, {"lang": "es", "value": "PHP 5.2.5 y anteriores permite a atacantes dependientes del contexto provocar denegaci\u00f3n de servicio (caida de aplicaci\u00f3n) a trav\u00e9s de una cadena larga en (1) el par\u00e1metro domain en la funci\u00f3n dgettext, el par\u00e1metro message en las funciones (2) dcgettext o (3) gettext, el par\u00e1metro msgid1 en las funciones (4) dngettext o (5) ngettext, o el par\u00e1metro (6) classname en la funci\u00f3n stream_wrapper_register. NOTA: esto podr\u00eda no ser una vulnerabilidad en muchos entornos de servidores web que soportan m\u00faltiples hilos, a menos que esta cuesti\u00f3n se pueda demostrar para la ejecuci\u00f3n de c\u00f3digo."}], "lastModified": "2018-10-15T21:49:26.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5B6B1C7-B7B8-495E-9FE5-FF39718DC64E", "versionEndIncluding": "5.2.4"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Red Hat doesn\u2019t consider this a security issue. The arguments to the functions in question should always be under the control of the script author, rather than untrusted script input, so these issues would not be treated as security-sensitive.", "lastModified": "2007-12-06T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}