CVE

Id
25058  
CVE No.
CVE-2007-1701  
Status
Candidate  
Description
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".  
Phase
Assigned (20070326)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
249214 25058 CVE-2007-1701 MISC:http://www.php-security.org/MOPB/MOPB-31-2007.html  View
249215 25058 CVE-2007-1701 GENTOO:GLSA-200705-19  View
249216 25058 CVE-2007-1701 URL:http://security.gentoo.org/glsa/glsa-200705-19.xml  View
249217 25058 CVE-2007-1701 HP:HPSBMA02215  View
249218 25058 CVE-2007-1701 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506  View
249219 25058 CVE-2007-1701 HP:SSRT071423  View
249220 25058 CVE-2007-1701 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506  View
249221 25058 CVE-2007-1701 HP:HPSBTU02232  View
249222 25058 CVE-2007-1701 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137  View
249223 25058 CVE-2007-1701 HP:SSRT071429  View
249224 25058 CVE-2007-1701 URL:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137  View
249225 25058 CVE-2007-1701 BID:23120  View
249226 25058 CVE-2007-1701 URL:http://www.securityfocus.com/bid/23120  View
249227 25058 CVE-2007-1701 OVAL:oval:org.mitre.oval:def:11034  View
249228 25058 CVE-2007-1701 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11034  View
249229 25058 CVE-2007-1701 VUPEN:ADV-2007-1991  View
249230 25058 CVE-2007-1701 URL:http://www.vupen.com/english/advisories/2007/1991  View
249231 25058 CVE-2007-1701 VUPEN:ADV-2007-2374  View
249232 25058 CVE-2007-1701 URL:http://www.vupen.com/english/advisories/2007/2374  View
249233 25058 CVE-2007-1701 SECUNIA:25445  View
249234 25058 CVE-2007-1701 URL:http://secunia.com/advisories/25445  View
249235 25058 CVE-2007-1701 SECUNIA:25423  View
249236 25058 CVE-2007-1701 URL:http://secunia.com/advisories/25423  View
249237 25058 CVE-2007-1701 SECUNIA:25850  View
249238 25058 CVE-2007-1701 URL:http://secunia.com/advisories/25850  View
249239 25058 CVE-2007-1701 XF:php-sessiondecode-code-execution(33658)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54899 JVNDB-2007-003591 Joomla! 用の RWCards の index.php における SQL インジェクションの脆弱性 Joomla! 用の RWCards の index.php には、SQL インジェクションの脆弱性が存在します。 CVE-2007-1703 25058 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-003591.html  View