CVE-2007-1380

NameCVE-2007-1380
DescriptionThe php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-1282-1, DSA-1283-1, DTSA-39-1, DTSA-40-1

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
php4sourcesarge4:4.3.10-20DSA-1282-1
php4sourceetch6:4.4.4-8+etch2DSA-1282-1
php4sourcelenny6:4.4.4-9+lenny1DTSA-40-1
php4source(unstable)6:4.4.6-1low
php5sourceetch5.2.0-8+etch3DSA-1283-1
php5sourcelenny5.2.0-10+lenny1DTSA-39-1
php5source(unstable)5.2.0-11low

Search for package or bug name: Reporting problems