CVE - CVE-2007-3998

CVE-ID
CVE-2007-3998	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:http://secweb.se/en/advisories/php-wordwrap-vulnerability/ CONFIRM:http://www.php.net/ChangeLog-5.php#5.2.4 CONFIRM:http://www.php.net/releases/5_2_4.php CONFIRM:https://issues.rpath.com/browse/RPL-1702 CONFIRM:https://issues.rpath.com/browse/RPL-1693 CONFIRM:http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm CONFIRM:https://launchpad.net/bugs/173043 DEBIAN:DSA-1444 URL:http://www.debian.org/security/2008/dsa-1444 DEBIAN:DSA-1578 URL:http://www.debian.org/security/2008/dsa-1578 FEDORA:FEDORA-2007-709 URL:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html GENTOO:GLSA-200710-02 URL:http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml MANDRIVA:MDKSA-2007:187 URL:http://www.mandriva.com/security/advisories?name=MDKSA-2007:187 REDHAT:RHSA-2007:0890 URL:http://www.redhat.com/support/errata/RHSA-2007-0890.html REDHAT:RHSA-2007:0889 URL:http://rhn.redhat.com/errata/RHSA-2007-0889.html REDHAT:RHSA-2007:0891 URL:http://www.redhat.com/support/errata/RHSA-2007-0891.html SUSE:SUSE-SA:2008:004 URL:http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html TRUSTIX:2007-0026 URL:http://www.trustix.org/errata/2007/0026/ UBUNTU:USN-549-1 URL:https://usn.ubuntu.com/549-1/ UBUNTU:USN-549-2 URL:http://www.ubuntu.com/usn/usn-549-2 OVAL:oval:org.mitre.oval:def:10603 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10603 VUPEN:ADV-2007-3023 URL:http://www.vupen.com/english/advisories/2007/3023 SECUNIA:26642 URL:http://secunia.com/advisories/26642 SECUNIA:26822 URL:http://secunia.com/advisories/26822 SECUNIA:26838 URL:http://secunia.com/advisories/26838 SECUNIA:26930 URL:http://secunia.com/advisories/26930 SECUNIA:26871 URL:http://secunia.com/advisories/26871 SECUNIA:26895 URL:http://secunia.com/advisories/26895 SECUNIA:26967 URL:http://secunia.com/advisories/26967 SECUNIA:27377 URL:http://secunia.com/advisories/27377 SECUNIA:27545 URL:http://secunia.com/advisories/27545 SECUNIA:27102 URL:http://secunia.com/advisories/27102 SECUNIA:27864 URL:http://secunia.com/advisories/27864 SECUNIA:28249 URL:http://secunia.com/advisories/28249 SECUNIA:28658 URL:http://secunia.com/advisories/28658 SECUNIA:30288 URL:http://secunia.com/advisories/30288
Assigning CNA
N/A
Date Entry Created
20070725	Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070725)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Use of the Common Vulnerabilities and Exposures (CVE®) List and the associated references from this website are subject to the terms of use. CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 1999–2018, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation. For more information, please contact us.