CVE-2007-4840
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service ...
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
Exploit likelihood
What each source reports
NVD Score used
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
CVE-2007-4840- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
CVE-2007-4840- Updated
- 2026-11-02
EUVDEUVD-2007-4821 No score
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
EUVD-2007-4821- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pgvh-6hc4-99ch No score
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service ...
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
GHSA-pgvh-6hc4-99ch- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
CVE-2007-4840- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4840 No score
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
- Record
DEBIAN-CVE-2007-4840- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4840 is a medium vulnerability (CVSS 5.0) in Php, published September 12, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.15%, the 88th percentile. Fixed in glibc 2.7-1.
References
lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html
issues.rpath.com/browse/RPL-1943
secunia.com/advisories/28658
gentoo.org/security/en/glsa/glsa-200710-02.xml
securityfocus.com/archive/1/478730/100/0/threaded
Show 9 moreShow less
securityreason.com/securityalert/3122
wiki.rpath.com/wiki/Advisories:rPSA-2007-0242
osvdb.org/38916
nvd.nist.gov/vuln/detail/CVE-2007-4840
github.com/advisories/GHSA-pgvh-6hc4-99ch
security-tracker.debian.org/tracker/CVE-2007-4840