CVE-2003-1307
** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write...
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
Exploit likelihood
What each source reports
NVD Score used
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
- Record
CVE-2003-1307- CVSS 2.0
- 4.3 Medium
AV:L/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
- Record
CVE-2003-1307- Updated
- 2026-11-02
EUVDEUVD-2003-1297 No score
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
- Record
EUVD-2003-1297- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jm5-c7cw-v9hh No score
** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write...
** DISPUTED ** The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP."
- Record
GHSA-8jm5-c7cw-v9hh- Updated
- 2026-11-02
OSV No score
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
- Record
CVE-2003-1307- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-1307 No score
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
- Record
DEBIAN-CVE-2003-1307- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
All versions, plus listed versions 2.4.57-22.4.57-32.4.58-12.4.59-12.4.59-1~deb10u1 Show 45 moreShow less2.4.59-1~deb11u12.4.59-1~deb12u12.4.59-22.4.60-12.4.61-12.4.61-1~deb11u12.4.61-1~deb12u12.4.62-12.4.62-1~deb11u12.4.62-1~deb11u22.4.62-1~deb12u12.4.62-1~deb12u22.4.62-22.4.62-32.4.62-42.4.62-52.4.62-62.4.63-12.4.64-12.4.65-12.4.65-1~deb11u12.4.65-1~deb12u12.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u12.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u1 |
None known |
apache2Debian:13 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
apache2Debian:14 |
All versions, plus listed versions 2.4.65-22.4.65-32.4.66-12.4.66-1~deb11u12.4.66-1~deb12u1 Show 27 moreShow less2.4.66-1~deb12u22.4.66-1~deb13u12.4.66-1~deb13u22.4.66-22.4.66-32.4.66-42.4.66-52.4.66-62.4.66-72.4.66-82.4.67-12.4.67-1~deb11u12.4.67-1~deb11u22.4.67-1~deb11u32.4.67-1~deb12u12.4.67-1~deb12u22.4.67-1~deb12u32.4.67-1~deb13u12.4.67-1~deb13u22.4.67-1~deb13u32.4.67-22.4.68-12.4.68-1~deb12u12.4.68-1~deb13u12.4.68-22.4.69-12.4.69-1~deb13u1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache 2.0.4x mod_php - File Descriptor Leakage (1) | 2003-12-26 |
| Exploit-DB | Apache 2.0.4x mod_php - File Descriptor Leakage (2) | 2003-12-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-1307 is a medium vulnerability (CVSS 4.3) in Apache Http Server, published December 31, 2003. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile.
References
securityfocus.com/archive/1/449234/100/0/threaded
bugs.php.net/38915
hackerdom.ru/~dimmo/phpexpl.c
nvd.nist.gov/vuln/detail/CVE-2003-1307
github.com/advisories/GHSA-8jm5-c7cw-v9hh
security-tracker.debian.org/tracker/CVE-2003-1307
Left out here: 9 versions. The JSON record has them.