CVE-2007-6039
LOW severity · CVSS 2.1 · Improper input validation
2.1CVSS LOW
Summary
PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impactNone
Integrity impactNone
Availability impact—
Exploit probability (EPSS)1%
AV:L/AC:L/Au:N/C:N/I:N/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- http://securityreason.com/securityalert/3365
- http://securityreason.com/securityalert/3366
- http://www.securityfocus.com/archive/1/483644/100/0/threaded
- http://www.securityfocus.com/archive/1/483648/100/0/threaded
- http://www.securityfocus.com/bid/26426
- http://www.securityfocus.com/bid/26428
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38442
- https://exchange.xforce.ibmcloud.com/vulnerabilities/38443