CVE-2007-0908: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 12.2% chance of exploitation in the next 30 days.

The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.

Affected products

• Canonical Ubuntu Linux: version 5.10 only; version 6.06 only; version 6.10 only
• PHP PHP: from 4.0.0, before 4.4.5 (fixed in 4.4.5); from 5.0.0, before 5.2.1 (fixed in 5.2.1); version 4.0 only

Published 2007-02-13. Last modified 2026-06-16.