CVE-2007-1701

Publication date 27 March 2007

Last updated 17 July 2025

Ubuntu priority

Medium

Why this priority?

Description

PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:".

Status

Package Ubuntu Release Status
php4 7.04 feisty Not in release
6.10 edgy
Not affected
6.06 LTS dapper
Not affected
php5 7.04 feisty
Not affected
6.10 edgy
Not affected
6.06 LTS dapper
Not affected

References

Other references