Description
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | php-8.4 | 8.4.12-r1 | — |
| Wolfi rolling | php-8.5 | 8.5.2-r0 | — |
References
- 25306 third-party-advisory
- http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html
- ADV-2007-1839 vdb-entry
- USN-485-1 vendor-advisory
- MDKSA-2007:187 vendor-advisory
- 26895 third-party-advisory
- 26102 third-party-advisory
- 36086 vdb-entry
- SUSE-SR:2007:015 vendor-advisory