CVE-2007-0909: PHP

High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days.

Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.

Affected products

• PHP PHP: version 3.0 only; version 3.0.1 only; version 3.0.2 only; version 3.0.3 only; version 3.0.4 only; version 3.0.5 only; …
• Trustix Secure Linux: version 2.2 only; version 3.0 only

Published 2007-02-13. Last modified 2026-06-16.