SB2015071707 - Ubuntu update for libapache2-mod-php5, php5-xmlrpc

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015071707

SB2015071707 - Ubuntu update for libapache2-mod-php5, php5-xmlrpc

Published: July 17, 2015 Updated: October 30, 2026

Security Bulletin ID SB2015071707
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 vulnerabilities.


1) Buffer overflow (CVE-ID: CVE-2007-1864)

CWE-ID: CWE-119 - Memory corruption

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the bundled libxmlrpc library in PHP before 4.4.7, and 5.x before 5.2.2, has unknown impact and remote attack vectors.


2) Input validation error (CVE-ID: CVE-2007-2728)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.


Remediation

Install update from vendor's website.

References