CVE-2007-1376

high · 7.5

The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate resource, as demonstrated by a GD Image resource.

7.5

CVSS

10.0%

EPSS (exploit prob.)

95th

EPSS percentile

2007-03-10

Published

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Vendor	Product	Affected versions
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0
php	php	4.0.0
php	php	4.0.1
php	php	4.0.1
php	php	4.0.1
php	php	4.0.2
php	php	4.0.3
php	php	4.0.3
php	php	4.0.4
php	php	4.0.4
php	php	4.0.5
php	php	4.0.6
php	php	4.0.7
php	php	4.0.7
php	php	4.0.7
php	php	4.0.7
php	php	4.1.0
php	php	4.1.1
php	php	4.1.2
php	php	4.2
php	php	4.2.0
php	php	4.2.1
php	php	4.2.2
php	php	4.2.3
php	php	4.3.0
php	php	4.3.1
php	php	4.3.2
php	php	4.3.3
php	php	4.3.4
php	php	4.3.5
php	php	4.3.6
php	php	4.3.7
php	php	4.3.8

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2007-1376