NetSight
IP …
low2.6

CVE-2007-2727

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitia…

Impact

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Affected products

VendorProductAffected versions
PhpPhp
from 4.4.0 before 4.4.7
from 5.0.0 before 5.2.2
Versions 4.0.1, 4.0.2, 4.0.3, 4.0.4

References