CVE DATABASE / CVE-2008-2108
CVE-2008-2108
CVSS 9.8 · CRITICAL
Summary
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.
CVSS 3.1 breakdown
| Base score | 9.8 (CRITICAL) |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Php phpFedoraproject fedoraCanonical ubuntu linuxDebian debian linux
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html
- http://secunia.com/advisories/30757
- http://secunia.com/advisories/30828
- http://secunia.com/advisories/31119
- http://secunia.com/advisories/31124
- http://secunia.com/advisories/31200
- http://secunia.com/advisories/32746
- http://secunia.com/advisories/35003
- http://security.gentoo.org/glsa/glsa-200811-05.xml
- http://securityreason.com/securityalert/3859
- http://www.debian.org/security/2009/dsa-1789
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:125
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:126
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:127
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:128
Data: NIST NVD. NVD last modified 2026-04-23. Always verify against the vendor advisory before acting.