NVD Vulnerability Detail

CVE-2007-4658

Summary	The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors, possibly related to a format string vulnerability.
Publication Date	Sept. 5, 2007, 7:17 a.m.
Registration Date	Jan. 29, 2021, 2:19 p.m.
Last Update	Oct. 4, 2018, 6:48 a.m.

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:5.0.0:beta2::::::
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:5.1.3:::::::*
cpe:2.3:a:php:php:5.1.4:::::::*
cpe:2.3:a:php:php:5.1.5:::::::*
cpe:2.3:a:php:php:5.1.6:::::::*
cpe:2.3:a:php:php:5.2.0:::::::*
cpe:2.3:a:php:php:5.2.1:::::::*
cpe:2.3:a:php:php:5.2.2:::::::*
cpe:2.3:a:php:php:5.2.3:::::::*
cpe:2.3:a:php:php:5.2.10:::::::*
cpe:2.3:a:php:php:5.2.11:::::::*
cpe:2.3:a:php:php:5.2.12:::::::*
cpe:2.3:a:php:php:5.2.13:::::::*
cpe:2.3:a:php:php:5.2.14:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.0:beta1::::::
cpe:2.3:a:php:php:4.0:beta2::::::
cpe:2.3:a:php:php:4.0:beta3::::::
cpe:2.3:a:php:php:4.0:beta4::::::
cpe:2.3:a:php:php:4.0:beta_4_patch1::::::
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:4.4.3:::::::*
cpe:2.3:a:php:php:4.4.4:::::::*
cpe:2.3:a:php:php:4.4.5:::::::*
cpe:2.3:a:php:php:4.4.6:::::::*
cpe:2.3:a:php:php:4.4.7:::::::*

Related information, measures and tools

No	URL	refsource	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html	SUSE
2	http://rhn.redhat.com/errata/RHSA-2007-0889.html	REDHAT
3	http://secunia.com/advisories/26642	SECUNIA	Patch Vendor Advisory
4	http://secunia.com/advisories/26822	SECUNIA	Vendor Advisory
5	http://secunia.com/advisories/26838	SECUNIA	Vendor Advisory
6	http://secunia.com/advisories/26871	SECUNIA	Vendor Advisory
7	http://secunia.com/advisories/26895	SECUNIA	Vendor Advisory
8	http://secunia.com/advisories/26930	SECUNIA	Vendor Advisory
9	http://secunia.com/advisories/26967	SECUNIA	Vendor Advisory
10	http://secunia.com/advisories/27102	SECUNIA	Vendor Advisory
11	http://secunia.com/advisories/27377	SECUNIA	Vendor Advisory
12	http://secunia.com/advisories/27545	SECUNIA	Vendor Advisory
13	http://secunia.com/advisories/27864	SECUNIA	Vendor Advisory
14	http://secunia.com/advisories/28249	SECUNIA	Vendor Advisory
15	http://secunia.com/advisories/28658	SECUNIA	Vendor Advisory
16	http://secunia.com/advisories/28936	SECUNIA	Vendor Advisory
17	http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136	SLACKWARE
18	http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm	CONFIRM
19	http://www.debian.org/security/2008/dsa-1444	DEBIAN
20	http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml	GENTOO
21	http://www.mandriva.com/security/advisories?name=MDKSA-2007:187	MANDRIVA
22	http://www.php.net/ChangeLog-4.php	CONFIRM
23	http://www.php.net/ChangeLog-5.php#5.2.4	CONFIRM	Patch
24	http://www.php.net/releases/4_4_8.php	CONFIRM
25	http://www.php.net/releases/5_2_4.php	CONFIRM
26	http://www.redhat.com/support/errata/RHSA-2007-0890.html	REDHAT
27	http://www.redhat.com/support/errata/RHSA-2007-0891.html	REDHAT
28	http://www.trustix.org/errata/2007/0026/	TRUSTIX
29	http://www.ubuntu.com/usn/usn-549-2	UBUNTU
30	http://www.vupen.com/english/advisories/2007/3023	VUPEN	Vendor Advisory
31	http://www.vupen.com/english/advisories/2008/0059	VUPEN	Vendor Advisory
32	https://exchange.xforce.ibmcloud.com/vulnerabilities/36377	XF
33	https://issues.rpath.com/browse/RPL-1693	CONFIRM
34	https://issues.rpath.com/browse/RPL-1702	CONFIRM
35	https://launchpad.net/bugs/173043	CONFIRM
36	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10363	OVAL
37	https://usn.ubuntu.com/549-1/	UBUNTU
38	https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html	FEDORA

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:php:php:5.0.0:::::::*
cpe:2.3:a:php:php:5.0.0:beta1::::::
cpe:2.3:a:php:php:5.0.0:beta2::::::
cpe:2.3:a:php:php:5.0.0:beta3::::::
cpe:2.3:a:php:php:5.0.0:beta4::::::
cpe:2.3:a:php:php:5.0.0:rc1::::::
cpe:2.3:a:php:php:5.0.0:rc2::::::
cpe:2.3:a:php:php:5.0.0:rc3::::::
cpe:2.3:a:php:php:5.0.1:::::::*
cpe:2.3:a:php:php:5.0.2:::::::*
cpe:2.3:a:php:php:5.0.3:::::::*
cpe:2.3:a:php:php:5.0.4:::::::*
cpe:2.3:a:php:php:5.0.5:::::::*
cpe:2.3:a:php:php:5.1.0:::::::*
cpe:2.3:a:php:php:5.1.1:::::::*
cpe:2.3:a:php:php:5.1.2:::::::*
cpe:2.3:a:php:php:5.1.3:::::::*
cpe:2.3:a:php:php:5.1.4:::::::*
cpe:2.3:a:php:php:5.1.5:::::::*
cpe:2.3:a:php:php:5.1.6:::::::*
cpe:2.3:a:php:php:5.2.0:::::::*
cpe:2.3:a:php:php:5.2.1:::::::*
cpe:2.3:a:php:php:5.2.2:::::::*
cpe:2.3:a:php:php:5.2.3:::::::*
cpe:2.3:a:php:php:5.2.10:::::::*
cpe:2.3:a:php:php:5.2.11:::::::*
cpe:2.3:a:php:php:5.2.12:::::::*
cpe:2.3:a:php:php:5.2.13:::::::*
cpe:2.3:a:php:php:5.2.14:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:php:php:4.0:beta1::::::
cpe:2.3:a:php:php:4.0:beta2::::::
cpe:2.3:a:php:php:4.0:beta3::::::
cpe:2.3:a:php:php:4.0:beta4::::::
cpe:2.3:a:php:php:4.0:beta_4_patch1::::::
cpe:2.3:a:php:php:4.0.0:::::::*
cpe:2.3:a:php:php:4.0.1:::::::*
cpe:2.3:a:php:php:4.0.2:::::::*
cpe:2.3:a:php:php:4.0.3:::::::*
cpe:2.3:a:php:php:4.0.4:::::::*
cpe:2.3:a:php:php:4.0.5:::::::*
cpe:2.3:a:php:php:4.0.6:::::::*
cpe:2.3:a:php:php:4.0.7:::::::*
cpe:2.3:a:php:php:4.1.0:::::::*
cpe:2.3:a:php:php:4.1.1:::::::*
cpe:2.3:a:php:php:4.1.2:::::::*
cpe:2.3:a:php:php:4.2.0:::::::*
cpe:2.3:a:php:php:4.2.1:::::::*
cpe:2.3:a:php:php:4.2.2:::::::*
cpe:2.3:a:php:php:4.2.3:::::::*
cpe:2.3:a:php:php:4.3.0:::::::*
cpe:2.3:a:php:php:4.3.1:::::::*
cpe:2.3:a:php:php:4.3.2:::::::*
cpe:2.3:a:php:php:4.3.3:::::::*
cpe:2.3:a:php:php:4.3.4:::::::*
cpe:2.3:a:php:php:4.3.5:::::::*
cpe:2.3:a:php:php:4.3.6:::::::*
cpe:2.3:a:php:php:4.3.7:::::::*
cpe:2.3:a:php:php:4.3.8:::::::*
cpe:2.3:a:php:php:4.3.9:::::::*
cpe:2.3:a:php:php:4.3.10:::::::*
cpe:2.3:a:php:php:4.3.11:::::::*
cpe:2.3:a:php:php:4.4.0:::::::*
cpe:2.3:a:php:php:4.4.1:::::::*
cpe:2.3:a:php:php:4.4.2:::::::*
cpe:2.3:a:php:php:4.4.3:::::::*
cpe:2.3:a:php:php:4.4.4:::::::*
cpe:2.3:a:php:php:4.4.5:::::::*
cpe:2.3:a:php:php:4.4.6:::::::*
cpe:2.3:a:php:php:4.4.7:::::::*