CVE-2007-2872

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-06-04 · updated 2026-06-16
Weakness: CWE-189

Description

Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.

Affected products

PHP: through 4.4.7; 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5 (+10)

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html
http://osvdb.org/36083
http://rhn.redhat.com/errata/RHSA-2007-0889.html
http://secunia.com/advisories/25456
http://secunia.com/advisories/25535
http://secunia.com/advisories/26048
http://secunia.com/advisories/26231
http://secunia.com/advisories/26838
http://secunia.com/advisories/26871

Get alerted when CVE-2007-2872 or the next vulnerability affects your stack