← Back

CVE-2007-2727

nvd nist
Published: May 16, 2007Modified: Apr 23, 2026

JSON object

Loading...
2.6
Vector
AV:N/AC:H/Au:N/C:P/I:N/A:N
Exploitability: 4.9 / Impact: 2.9
Source: NVD

Description

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Affected (34)

Products: Php: Php
Php
1 product
Php
Configuration A
34 vulnerable
Vulnerable SoftwareAffected Versions
Php
Php
From 4.4.0 to 4.4.7
Php
From 5.0.0 to 5.2.2
Php
Version 4.0.1
Php
Version 4.0.1 patch1
Php
Version 4.0.1 patch2
Php
Version 4.0.2
Php
Version 4.0.3
Php
Version 4.0.3 patch1
Php
Version 4.0.4
Php
Version 4.0.5
Php
Version 4.0.6
Php
Version 4.0.7
Php
Version 4.0.7 rc1
Php
Version 4.0.7 rc2
Php
Version 4.0.7 rc3
Php
Version 4.1.0
Php
Version 4.1.1
Php
Version 4.1.2
Php
Version 4.2.0
Php
Version 4.2.1
Php
Version 4.2.2
Php
Version 4.2.3
Php
Version 4.3.0
Php
Version 4.3.10
Php
Version 4.3.11
Php
Version 4.3.1
Php
Version 4.3.2
Php
Version 4.3.3
Php
Version 4.3.4
Php
Version 4.3.5
Php
Version 4.3.6
Php
Version 4.3.7
Php
Version 4.3.8
Php
Version 4.3.9

References (20)

Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
ExploitPatchThird Party Advisory
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry

Timeline

No history available yet.