Every CVE Search/ Get API key

CVE-2007-1521

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent...

6.8 MediumPublic exploit

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

Exploit likelihood

8.61%Down 19.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.8

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

Record
CVE-2007-1521
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated
2026-11-02
CVE List No score

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

Record
CVE-2007-1521
Updated
2026-11-02
EUVDEUVD-2007-1515 No score

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

Record
EUVD-2007-1515
Updated
2026-11-03
GitHub AdvisoriesGHSA-68q8-gr3h-67jh No score

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent...

Double free vulnerability in PHP before 4.4.7, and 5.x before 5.2.2, allows context-dependent attackers to execute arbitrary code by interrupting the session_regenerate_id function, as demonstrated by calling a userspace error handler or triggering a memory limit violation.

Record
GHSA-68q8-gr3h-67jh
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php4
Debian:3.1
From an advisory covering 7 CVEs
 before 4:4.3.10-20, plus listed versions
4:4.3.10-154:4.3.10-164:4.3.10-174:4.3.10-184:4.3.10-19
4:4.3.10-20
php4
Debian:4.0
From an advisory covering 7 CVEs
 before 6:4.4.4-8+etch2, plus listed versions
6:4.4.4-8+etch1
6:4.4.4-8+etch2
php5
Debian:4.0
From an advisory covering 17 CVEs
 before 5.2.0-8+etch3, plus listed versions
5.2.0-8+etch1
5.2.0-8+etch3
php5
Debian:5.0
From an advisory covering 18 CVEs
 before 5.2.0-10+lenny1
5.2.0-10+lenny1
php4
Debian:5.0
From an advisory covering 7 CVEs
 before 6:4.4.4-9+lenny1, plus listed versions
4.0.3pl1-0potato34.0.3pl1-0potato44:4.1.2-74:4.1.2-7.0.14:4.1.2-7.woody3
Show 41 moreShow less
4:4.1.2-7.woody44:4.1.2-7.woody54:4.1.2-7woody14:4.1.2-7woody24:4.3.10-104:4.3.10-114:4.3.10-124:4.3.10-134:4.3.10-144:4.3.10-154:4.3.10-164:4.3.10-174:4.3.10-184:4.3.10-194:4.3.10-204:4.3.10-214:4.3.10-224:4.3.10-84:4.3.10-94:4.4.0-14:4.4.0-24:4.4.0-34:4.4.0-44:4.4.2-14:4.4.2-1+b14:4.4.2-1.14:4.4.4-14:4.4.4-24:4.4.4-34:4.4.4-44:4.4.4-4~44:4.4.4-54:4.4.4-64:4.4.4-76:4.4.4-86:4.4.4-8+etch16:4.4.4-8+etch26:4.4.4-8+etch36:4.4.4-8+etch46:4.4.4-8+etch66:4.4.4-9
6:4.4.4-9+lenny1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP 5.2.1 - 'session_regenerate_id()' Double-Free2007-03-14

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
aliases
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-1521 is a medium vulnerability (CVSS 6.8) in Php, published March 20, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.61%, the 95th percentile. No source names a fixed version.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open