← back
CVE-2007-1399

CVE-2007-1399

EPSS 19.8%
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/3440unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.htmlhttp://secunia.com/advisories/24471http://secunia.com/advisories/24514http://secunia.com/advisories/25938https://exchange.xforce.ibmcloud.com/vulnerabilities/32889http://www.debian.org/security/2007/dsa-1330http://www.osvdb.org/32782http://www.php-security.org/MOPB/MOPB-16-2007.htmlhttp://www.securityfocus.com/bid/22883http://www.vupen.com/english/advisories/2007/0898