NVD

Id
53880  
Name
CVE-2007-1700  
Description
The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2007-03-26  
Modified Date
2012-11-05  
Seq
2007-1700  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
273169 53880 CVE-2007-1700 HPSBMA02215  View
273170 53880 CVE-2007-1700 HPSBTU02232  View
273171 53880 CVE-2007-1700 GLSA-200705-19  View
273172 53880 CVE-2007-1700 DSA-1283  View
273173 53880 CVE-2007-1700 SUSE-SA:2007:032  View
273174 53880 CVE-2007-1700 http://www.php-security.org/MOPB/MOPB-30-2007.html  View
273175 53880 CVE-2007-1700 23119  View
273176 53880 CVE-2007-1700 USN-455-1  View
273177 53880 CVE-2007-1700 ADV-2007-1991  View
273178 53880 CVE-2007-1700 ADV-2007-2374  View
273179 53880 CVE-2007-1700 php-session-extension-code-execution(33520)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
54897 JVNDB-2007-003589 PHP のセッションエクステンションにおける任意のコードを実行される脆弱性 PHP のセッションエクステンションには、セッショングローバルから内部ポインタを考慮せずセッション変数の参照カウントを計算するため、任意のコードを実行される脆弱性が存在します。 CVE-2007-1700 25055 CVE-2007-1700 53880 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-003589.html 2007-03-24 2012-09-25 View