Description
Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411, it appears that this issue might be subsumed by CVE-2007-0906.3.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | php +18 | 5.1.6-7.el5 | RHSA-2007:0082 |
| RHEL 4 | php +13 | 4.3.9-3.22.3 | RHSA-2007:0076 |
| RHEL 3 | php +6 | 4.3.2-39.ent | RHSA-2007:0076 |
| RHEL 2 | php +7 | 4.1.2-2.14 | RHSA-2007:0081 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Stronghold 4 | stronghold-php +8 | 4.1.2-12 | RHSA-2007:0089 |
| Red Hat Rhel Application Stack 1 | php +18 | 5.1.6-3.el4s1.5 | RHSA-2007:0088 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PHP 5.1.6 - 'Imap_Mail_Compose()' Remote Buffer Overflow EDB-29807 · remote · Mar 31, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2007:0089 Red Hat Security Advisory: php security update for Stronghold Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0088 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0082 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0076 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2007:0081 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- oval:org.mitre.oval:def:10377 vdb-entry signature
- http://www.php-security.org/MOPB/MOPB-40-2007.html
- 23234 vdb-entry
- php-imapmailcompose-bo(33534) vdb-entry