CVE-2007-2872: PHP

Medium severity, CVSS 6.8. EPSS: 8.9% chance of exploitation in the next 30 days.

Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.

Affected products

• PHP PHP: up to and including 4.4.7; version 5.0.0 only; version 5.0.1 only; version 5.0.2 only; version 5.0.3 only; version 5.0.4 only; …

Published 2007-06-04. Last modified 2026-06-16.