CVE-2007-1521 Use after free in n/a
Attackers can execute arbitrary code by interrupting session regeneration in PHP, potentially compromising web applications using this library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-1521?
CVE-2007-1521 is a medium-severity use after free vulnerability in Php Php, published on 20 Mar 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.
Which versions are affected by CVE-2007-1521?
It affects 1 product.
Products include Php Php.
How do I fix CVE-2007-1521?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2007-1521 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1521 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Php Php
Sources
Also known as GHSA-68q8-gr3h-67jh.