CVE-2007-2728: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days.

The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.

Affected products

• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only
• PHP PHP: affected versions not specified

Published 2007-05-16. Last modified 2026-06-16.