CVE-2007-3998

Published: Sep 4, 2007Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ""' argument set.

Affected (8)

Products: Php: Php · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Php Php	From 4.0.0 to 4.4.8
Php Php	From 5.0.0 to 5.2.4

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 6.10
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (70)

http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2007-0889.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26642

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26822

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26838

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26871

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26895

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26930

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/26967

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/27102

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/27377

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/27545

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/27864

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28249

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28658

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30288

Source: cve@mitre.org

Third Party Advisory

http://secweb.se/en/advisories/php-wordwrap-vulnerability/

Source: cve@mitre.org

Third Party Advisory

http://support.avaya.com/elmodocs2/security/ASA-2007-449.htm

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1444

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1578

Source: cve@mitre.org

Third Party Advisory

http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:187

Source: cve@mitre.org

Third Party Advisory

http://www.php.net/ChangeLog-5.php#5.2.4

Source: cve@mitre.org

Vendor Advisory

http://www.php.net/releases/5_2_4.php

Source: cve@mitre.org

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2007-0890.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2007-0891.html

Source: cve@mitre.org

Third Party Advisory

http://www.trustix.org/errata/2007/0026/

Source: cve@mitre.org

Broken Link

http://www.ubuntu.com/usn/usn-549-2

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2007/3023

Source: cve@mitre.org

Permissions RequiredThird Party Advisory

https://issues.rpath.com/browse/RPL-1693

Source: cve@mitre.org

Broken Link

https://issues.rpath.com/browse/RPL-1702

Source: cve@mitre.org

Broken Link

https://launchpad.net/bugs/173043

Source: cve@mitre.org

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10603

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/549-1/

Source: cve@mitre.org

Third Party Advisory

https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00354.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html