Vulnerability Details : CVE-2007-3998
The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
Vulnerability category: Denial of service
Products affected by CVE-2007-3998
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
Threat overview for CVE-2007-3998
Top countries where our scanners detected CVE-2007-3998
Top open port discovered on systems with this issue
80
IPs affected by CVE-2007-3998 24,373
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2007-3998!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2007-3998
6.47%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2007-3998
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2007-3998
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2007-3998
-
Red Hat 2007-09-05This issue did not affect the versions of PHP as shipped with Red Hat Enterprise Linux 2.1.
References for CVE-2007-3998
-
http://rhn.redhat.com/errata/RHSA-2007-0889.html
RHSA-2007:0889 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2007-0890.html
SupportThird Party Advisory
-
http://www.php.net/ChangeLog-5.php#5.2.4
PHP: PHP 5 ChangeLogVendor Advisory
-
http://secunia.com/advisories/26930
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/28658
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/27377
About Secunia Research | FlexeraThird Party Advisory
-
https://issues.rpath.com/browse/RPL-1702
Broken Link
-
http://secunia.com/advisories/27102
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/30288
Third Party Advisory
-
http://secunia.com/advisories/26642
About Secunia Research | FlexeraThird Party Advisory
-
http://www.trustix.org/errata/2007/0026/
Trustix | Empowering Trust and Security in the Digital AgeBroken Link
-
http://secweb.se/en/advisories/php-wordwrap-vulnerability/
Third Party Advisory
-
http://secunia.com/advisories/26871
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/26967
About Secunia Research | FlexeraThird Party Advisory
-
http://www.vupen.com/english/advisories/2007/3023
Site en constructionPermissions Required;Third Party Advisory
-
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html
[SECURITY] Fedora Core 6 Update: php-5.1.6-3.7.fc6Third Party Advisory
-
http://secunia.com/advisories/27545
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/26822
About Secunia Research | FlexeraThird Party Advisory
-
https://usn.ubuntu.com/549-1/
404: Page not found | UbuntuThird Party Advisory
-
http://secunia.com/advisories/27864
About Secunia Research | FlexeraThird Party Advisory
-
http://www.debian.org/security/2008/dsa-1444
Third Party Advisory
-
http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm
ASA-2007-449 (RHSA-2007-0888, RHSA-2007-0889 & RHSA-2007-0890)Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html
[security-announce] SUSE Security Announcement: php4, php5 (SUSE-SA:2008:004) - openSUSE Security Announce - openSUSE Mailing ListsThird Party Advisory
-
http://www.redhat.com/support/errata/RHSA-2007-0891.html
SupportThird Party Advisory
-
http://secunia.com/advisories/26895
About Secunia Research | FlexeraThird Party Advisory
-
http://www.debian.org/security/2008/dsa-1578
Third Party Advisory
-
http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml
PHP: Multiple vulnerabilities (GLSA 200710-02) — Gentoo securityThird Party Advisory
-
http://www.php.net/releases/5_2_4.php
PHP: PHP 5.2.4 Release AnnouncementVendor Advisory
-
http://secunia.com/advisories/26838
About Secunia Research | FlexeraThird Party Advisory
-
http://secunia.com/advisories/28249
Third Party Advisory
-
https://launchpad.net/bugs/173043
Bug #173043 “php5 5.2.3-1ubuntu6.1 introduced segfault regressio...” : Bugs : php5 package : UbuntuThird Party Advisory
-
https://issues.rpath.com/browse/RPL-1693
Broken Link
-
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187
MandrivaThird Party Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10603
Third Party Advisory
-
http://www.ubuntu.com/usn/usn-549-2
USN-549-2: PHP regression | Ubuntu security notices | UbuntuThird Party Advisory
Jump to