CVE-2007-1700

Name	CVE-2007-1700
Description	The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1283-1, DTSA-39-1

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
php4	source	sarge	4:4.3.10-21
php4	source	etch	6:4.4.4-8+etch1
php4	source	(unstable)	6:4.4.4-9
php5	source	etch	5.2.0-8+etch3	DSA-1283-1
php5	source	lenny	5.2.0-10+lenny1	DTSA-39-1
php5	source	(unstable)	5.2.0-9

Notes

This was fixed as a side-effect of previous security fixes, noting the
status as of DSA-1286 as fixed version. likewise the oldstable
version was fixed.