CVE Vulnerabilities

CVE-2007-2727

Published: May 16, 2007 | Modified: Nov 07, 2022
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
2.6 LOW
AV:N/AC:H/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu
LOW

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Affected Software

Name Vendor Start Version End Version
Php Php 4.4.0 (including) 4.4.7 (excluding)
Php Php 5.0.0 (including) 5.2.2 (excluding)
Php Php 4.0.1 (including) 4.0.1 (including)
Php Php 4.0.1-patch1 (including) 4.0.1-patch1 (including)
Php Php 4.0.1-patch2 (including) 4.0.1-patch2 (including)
Php Php 4.0.2 (including) 4.0.2 (including)
Php Php 4.0.3 (including) 4.0.3 (including)
Php Php 4.0.3-patch1 (including) 4.0.3-patch1 (including)
Php Php 4.0.4 (including) 4.0.4 (including)
Php Php 4.0.5 (including) 4.0.5 (including)
Php Php 4.0.6 (including) 4.0.6 (including)
Php Php 4.0.7 (including) 4.0.7 (including)
Php Php 4.0.7-rc1 (including) 4.0.7-rc1 (including)
Php Php 4.0.7-rc2 (including) 4.0.7-rc2 (including)
Php Php 4.0.7-rc3 (including) 4.0.7-rc3 (including)
Php Php 4.1.0 (including) 4.1.0 (including)
Php Php 4.1.1 (including) 4.1.1 (including)
Php Php 4.1.2 (including) 4.1.2 (including)
Php Php 4.2.0 (including) 4.2.0 (including)
Php Php 4.2.1 (including) 4.2.1 (including)
Php Php 4.2.2 (including) 4.2.2 (including)
Php Php 4.2.3 (including) 4.2.3 (including)
Php Php 4.3.0 (including) 4.3.0 (including)
Php Php 4.3.1 (including) 4.3.1 (including)
Php Php 4.3.2 (including) 4.3.2 (including)
Php Php 4.3.3 (including) 4.3.3 (including)
Php Php 4.3.4 (including) 4.3.4 (including)
Php Php 4.3.5 (including) 4.3.5 (including)
Php Php 4.3.6 (including) 4.3.6 (including)
Php Php 4.3.7 (including) 4.3.7 (including)
Php Php 4.3.8 (including) 4.3.8 (including)
Php Php 4.3.9 (including) 4.3.9 (including)
Php Php 4.3.10 (including) 4.3.10 (including)
Php Php 4.3.11 (including) 4.3.11 (including)
Php-mcrypt Ubuntu dapper *
Php-mcrypt Ubuntu edgy *
Php-mcrypt Ubuntu feisty *

References