NVD

Id
53566  
Name
CVE-2007-1381  
Description
The wddx_deserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code via a WDDX packet with a malformed overlap of a STRING element, which triggers a buffer overflow.  
Reject
 
CVSS Version
2  
CVSS Score
7.6  
Severity
High  
CVSS Base Score
7.6  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-03-09  
Modified Date
2008-09-05  
Seq
2007-1381  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
271442 53566 CVE-2007-1381 http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?r1=1.119.2.10.2.13&r2=1.119.2.10.2.14  View
271443 53566 CVE-2007-1381 http://cvs.php.net/viewvc.cgi/php-src/ext/wddx/wddx.c?revision=1.119.2.10.2.14&view=markup  View
271444 53566 CVE-2007-1381 http://www.php-security.org/MOPB/MOPB-09-2007.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
54791 JVNDB-2007-003483 PHP の wddx.c における任意のコードを実行される脆弱性 PHP の wddx.c の wddx_deserialize 関数は、strlcat が想定されているところで strlcpy が呼び出され不適切な引数を使用するため、任意のコードを実行される脆弱性が存在します。 CVE-2007-1381 24736 CVE-2007-1381 53566 7.6 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-003483.html 2007-03-04 2012-09-25 View