The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2007-0154.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2007-0155.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2007-0163.html cve-icon cve-icon
http://secunia.com/advisories/24909 cve-icon cve-icon
http://secunia.com/advisories/24910 cve-icon cve-icon
http://secunia.com/advisories/24924 cve-icon cve-icon
http://secunia.com/advisories/24941 cve-icon cve-icon
http://secunia.com/advisories/24945 cve-icon cve-icon
http://secunia.com/advisories/25445 cve-icon cve-icon
http://secunia.com/advisories/26048 cve-icon cve-icon
http://secunia.com/advisories/26642 cve-icon cve-icon
http://secunia.com/advisories/27864 cve-icon cve-icon
http://secunia.com/advisories/28936 cve-icon cve-icon
http://security.gentoo.org/glsa/glsa-200705-19.xml cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.335136 cve-icon cve-icon
http://us2.php.net/releases/4_4_7.php cve-icon cve-icon
http://us2.php.net/releases/5_2_2.php cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2007:087 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2007:088 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2007:089 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDKSA-2007:090 cve-icon cve-icon
http://www.osvdb.org/32769 cve-icon cve-icon
http://www.php-security.org/MOPB/MOPB-03-2007.html cve-icon cve-icon
http://www.php.net/ChangeLog-4.php cve-icon cve-icon
http://www.php.net/ChangeLog-5.php#5.2.4 cve-icon cve-icon
http://www.php.net/releases/4_4_8.php cve-icon cve-icon
http://www.php.net/releases/5_2_4.php cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2007-0082.html cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2007-0162.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/466166/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/22764 cve-icon cve-icon
http://www.securitytracker.com/id?1017771 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-549-2 cve-icon cve-icon
https://issues.rpath.com/browse/RPL-1268 cve-icon cve-icon
https://launchpad.net/bugs/173043 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2007-1285 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11017 cve-icon cve-icon
https://usn.ubuntu.com/549-1/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2007-1285 cve-icon
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.08367}

epss

{'score': 0.06889}


cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-07T12:50:35.022Z

Reserved: 2007-03-06T00:00:00

Link: CVE-2007-1285

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2007-03-06T20:19:00.000

Modified: 2025-04-09T00:30:58.490

Link: CVE-2007-1285

cve-icon Redhat

Severity : Moderate

Publid Date: 2007-03-01T00:00:00Z

Links: CVE-2007-1285 - Bugzilla

cve-icon OpenCVE Enrichment

No data.