CVE-2007-2510

Description

Buffer overflow in the make_http_soap_request function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" (slash) characters.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 5.0	php5	5.2.0-10+lenny1	DTSA-39-1
Debian 4.0	php5	5.2.0-8+etch4	DSA-1295-1

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 5	php +18	5.1.6-12.el5	RHSA-2007:0348

Show 1 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Red Hat Rhel Application Stack 1	php +18	5.1.6-3.el4s1.7	RHSA-2007:0355

Advisories 4

RHSA-2007:0348 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
DSA-1295-1 php5 Debian Security (DSA / DLA) · Mar 9, 2026
DTSA-39-1 php5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
RHSA-2007:0355 Red Hat Security Advisory: php security update Red Hat Security Advisories (RHSA) · Nov 22, 2025

References

25187 third-party-advisory
25191 third-party-advisory
USN-462-1 vendor-advisory
MDKSA-2007:102 vendor-advisory
26048 third-party-advisory
RHSA-2007:0355 vendor-advisory
GLSA-200705-19 vendor-advisory
2007-0017 vendor-advisory
23813 vdb-entry
http://viewcvs.php.net/viewvc.cgi/php-src/ext/soap/php_http.c?r1=1.77.2.11.2.5&r2=1.77.2.11.2.6
DSA-1295 vendor-advisory
25318 third-party-advisory
34675 vdb-entry
oval:org.mitre.oval:def:10715 vdb-entry signature
24034 vdb-entry
http://us2.php.net/releases/5_2_2.php
1018023 vdb-entry
25255 third-party-advisory
25445 third-party-advisory
25372 third-party-advisory
RHSA-2007:0348 vendor-advisory
SUSE-SA:2007:044 vendor-advisory