CVE-2007-1900

Description

CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter in ext/filter in PHP 5.2.0 and 5.2.1 allows context-dependent attackers to inject arbitrary e-mail headers via an e-mail address with a '\n' character, which causes a regular expression to ignore the subsequent part of the address string.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.89% Top 30%

Vendor Advisory debian.org Vendor Advisory gentoo.org Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory trustix.org Vendor Advisory ubuntu.com Vendor Advisory slackware.com Vendor Advisory hp.com Vendor Advisory novell.com Vendor Advisory secunia.com Vendor Advisory php-security.org

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/26231	third party advisory
http://secunia.com/advisories/25056	third party advisory
http://secunia.com/advisories/27110	third party advisory
http://www.debian.org/security/2007/dsa-1283	vendor advisory
http://www.osvdb.org/33962	vdb entry
http://security.gentoo.org/glsa/glsa-200705-19.xml	vendor advisory
http://www.vupen.com/english/advisories/2007/2016	vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/33510	vdb entry
http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6067	vdb entry signature
http://secunia.com/advisories/25062	third party advisory
http://www.php-security.org/MOPB/PMOPB-45-2007.html	vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00397.html	vendor advisory
http://secunia.com/advisories/24824	third party advisory vendor advisory
http://www.trustix.org/errata/2007/0023/	vendor advisory
http://www.ubuntu.com/usn/usn-455-1	vendor advisory
http://www.vupen.com/english/advisories/2007/3386	vdb entry
http://secunia.com/advisories/27037	third party advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.482863	vendor advisory
http://www.php.net/releases/5_2_3.php
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor advisory
http://secunia.com/advisories/25535	third party advisory
http://secunia.com/advisories/27102	third party advisory
http://secunia.com/advisories/25445	third party advisory
http://www.securityfocus.com/bid/23359	vdb entry
http://secunia.com/advisories/25057	third party advisory
http://www.novell.com/linux/security/advisories/2007_32_php.html	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2007-1900?: CVE-2007-1900 has been scored as a medium severity vulnerability.
How to fix CVE-2007-1900?: To fix CVE-2007-1900, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-1900 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2007-1900 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.