CVE-2007-3806
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service...
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
Exploit likelihood
What each source reports
NVD Score used
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
- Record
CVE-2007-3806- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20, CWE-399
- Updated
- 2026-11-02
CVE List No score
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
- Record
CVE-2007-3806- Updated
- 2026-11-02
EUVDEUVD-2007-3790 No score
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
- Record
EUVD-2007-3790- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5ff-24v2-wj9j No score
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service...
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
- Record
GHSA-x5ff-24v2-wj9j- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php5Debian:4.0 From an advisory covering 4 CVEs |
before 5.2.0-8+etch11, plus listed versions 5.2.0-8+etch15.2.0-8+etch105.2.0-8+etch11~p15.2.0-8+etch35.2.0-8+etch4 Show 6 moreShow less5.2.0-8+etch5~pu15.2.0-8+etch65.2.0-8+etch75.2.0-8+etch85.2.0-8+etch95.2.0-8+etch9~bpo31+1 |
5.2.0-8+etch11 |
php4Debian:4.0 From an advisory covering 5 CVEs |
before 6:4.4.4-8+etch6, plus listed versions 6:4.4.4-8+etch16:4.4.4-8+etch26:4.4.4-8+etch36:4.4.4-8+etch4 |
6:4.4.4-8+etch6 |
php5Debian:5.0 From an advisory covering 8 CVEs |
before 5.2.3-1+lenny1 | 5.2.3-1+lenny1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | PHP 5.2.3 - 'glob()' Denial of Service | 2007-07-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3806 is a medium vulnerability (CVSS 6.8) in Php, published July 17, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 10.7%, the 95th percentile. No source names a fixed version.
References
secunia.com/advisories/30288
cvs.php.net/viewvc.cgi/php-src/ext/standard/dir.c?r1=1.166&r2=1.167
osvdb.org/36085
vupen.com/english/advisories/2007/2547
exchange.xforce.ibmcloud.com/vulnerabilities/35437
exploit-db.com/exploits/4181
Show 14 moreShow less
debian.org/security/2008/dsa-1572
gentoo.org/security/en/glsa/glsa-200710-02.xml
php.net/ChangeLog-5.php
securityfocus.com/bid/24922
nvd.nist.gov/vuln/detail/CVE-2007-3806
github.com/advisories/GHSA-x5ff-24v2-wj9j