CVE DATABASE / CVE-2007-1285
CVE-2007-1285
CVSS 7.5 · HIGH
Summary
The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
CVSS 3.1 breakdown
| Base score | 7.5 (HIGH) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | NONE |
| Integrity | NONE |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Php phpCanonical ubuntu linuxNovell suse linuxSuse linux enterprise serverRedhat enterprise linux desktopRedhat enterprise linux serverRedhat enterprise linux workstation
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2007-0154.html
- http://rhn.redhat.com/errata/RHSA-2007-0155.html
- http://rhn.redhat.com/errata/RHSA-2007-0163.html
- http://secunia.com/advisories/24909
- http://secunia.com/advisories/24910
- http://secunia.com/advisories/24924
- http://secunia.com/advisories/24941
- http://secunia.com/advisories/24945
- http://secunia.com/advisories/25445
- http://secunia.com/advisories/26048
- http://secunia.com/advisories/26642
- http://secunia.com/advisories/27864
- http://secunia.com/advisories/28936
- http://security.gentoo.org/glsa/glsa-200705-19.xml
Data: NIST NVD. NVD last modified 2026-04-23. Always verify against the vendor advisory before acting.