Bug 239012 (CVE-2007-2510)

Summary:	CVE-2007-2510 php make_http_soap_request flaw
Product:	[Other] Security Response	Reporter:	Mark J. Cox <mjc>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jorton
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-01-16 17:03:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	239015, 239016, 239020, 239026, 239566
Bug Blocks:

Description Mark J. Cox 2007-05-04 13:28:56 UTC

The PHP update on 20070504 stated "-Fixed a remotely trigger-able buffer
overflow inside make_http_soap_request(). (CVE-NO-NAME, by Ilia Alshanetsky)"

Comment 1 Mark J. Cox 2007-05-08 15:32:06 UTC

text "A buffer overflow flaw was found in the PHP 'soap' extension, regarding the
handling of an HTTP redirect response when using the SOAP client provided
by this extension with an untrusted SOAP server. No mechanism to trigger
this flaw remotely is known. (CVE-2007-2510)"

Comment 2 Red Hat Product Security 2008-01-16 17:03:22 UTC

This issue was addressed in:

Red Hat Application Stack:
  http://rhn.redhat.com/errata/RHSA-2007-0355.html

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0348.html

Fedora:
  updated to fixed upstream version