Bug 242032 (CVE-2007-2872)

Summary: CVE-2007-2872 php chunk_split integer overflow
Product: [Other] Security Response Reporter: Joe Orton <jorton>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: kreilly
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-01-16 14:06:10 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 242908, 278351, 278361, 278381, 278391, 278401, 278411, 278421    
Bug Blocks:    

Description Joe Orton 2007-06-01 12:35:51 UTC
Description of problem:
PHP 5.2.3 release: http://www.php.net/releases/5_2_3.php

Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872)

Comment 1 Mark J. Cox 2007-06-01 14:10:52 UTC
impact=moderate based on analysis of the vulnerability.  Note that to exploit
this the attacker would need to be able to supply an arbitrary argument as a 3rd
argument to chunk_split.  Most scripts that use chunk_script do not specify a
3rd argument or use a fixed argument.

Comment 2 Mark J. Cox 2007-09-03 15:15:17 UTC
note a more complete fix was included with PHP 5.2.4 release

Comment 8 Red Hat Product Security 2008-01-16 14:06:10 UTC
This issue was addressed in:

Red Hat Application Stack:
  http://rhn.redhat.com/errata/RHSA-2007-0891.html

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0890.html
  http://rhn.redhat.com/errata/RHSA-2007-0889.html
  http://rhn.redhat.com/errata/RHSA-2007-0888.html

Fedora:
  updated to fixed upstream version