Vulnerability Database

300,445

Total vulnerabilities in the database

CVE-2007-0908

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

  • Published: Feb 13, 2007
  • Updated: Nov 9, 2025
  • CVE: CVE-2007-0908
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
php / php 4.0-beta1 4.0-beta1.x
php / php 4.0-beta4 4.0-beta4.x
php / php 4.0-rc1 4.0-rc1.x
php / php 4.0 4.0.x
php / php 4.0-beta2 4.0-beta2.x
php / php 4.0-rc2 4.0-rc2.x
php / php 4.0-beta_4_patch1 4.0-beta_4_patch1.x
php / php 4.0-beta3 4.0-beta3.x
php / php 4.0.0 4.4.5
php / php 5.0.0 5.2.1
canonical / ubuntu_linux 6.06 6.06.x
canonical / ubuntu_linux 6.10 6.10.x
canonical / ubuntu_linux 5.10 5.10.x