CVE-2007-1711: PHP

Medium severity, CVSS 6.8. EPSS: 7.6% chance of exploitation in the next 30 days.

Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).

Affected products

• PHP PHP: version 4.4.5 only; version 4.4.6 only

Published 2007-03-27. Last modified 2026-06-16.