NetSight
IP …
medium5.0Public exploit code

CVE-2007-0908

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical k…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

Affected products

VendorProductAffected versions
PhpPhp
from 4.0.0 before 4.4.5
from 5.0.0 before 5.2.1
Version 4.0
CanonicalUbuntu Linux
Versions 5.10, 6.06, 6.10

Weakness classification

CWE-20

References