CVE-2007-4727
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi...
CVE-2007-4727 is a medium vulnerability (CVSS 6.8) in Lighttpd, published August 29, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.9%, the 96th percentile. Fixed in lighttpd 1.4.18-1.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 12.9%EPSS, 96th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.18-1lighttpd +3 more
Description
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 | before 1.4.18-1 | 1.4.18-1 |
lighttpdDebian:13 | before 1.4.18-1 | 1.4.18-1 |
lighttpdDebian:14 | before 1.4.18-1 | 1.4.18-1 |
lighttpdDebian:4.0 From an advisory covering 5 CVEs | before 1.4.13-4etch4, plus listed versions 1.4.13-41.4.13-4etch11.4.13-4etch21.4.13-4etch3 | 1.4.13-4etch4 |
What each source reports
NVD Score used
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
CVE-2007-4727- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
CVE-2007-4727- Updated
- 2026-11-02
EUVDEUVD-2007-4708No score
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
EUVD-2007-4708- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fr6-p7rj-wmfrNo score
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi...
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
GHSA-8fr6-p7rj-wmfr- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
CVE-2007-4727- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4727No score
Buffer overflow in the fcgi_env_add function in mod_proxy_backend_fastcgi.c in the mod_fastcgi extension in lighttpd before 1.4.18 allows remote attackers to overwrite arbitrary CGI variables and execute arbitrary code via an HTTP request with a long content length, as demonstrated by overwriting the SCRIPT_FILENAME variable, aka a "header overflow."
- Record
DEBIAN-CVE-2007-4727- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, published, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
issues.rpath.com/browse/RPL-1715
securityfocus.com/archive/1/479763/100/0/threaded
fedoranews.org/updates/FEDORA-2007-213.shtml
secunia.com/advisories/26732
gentoo.org/security/en/glsa/glsa-200709-16.xml
secweb.se/en/advisories/lighttpd-fastcgi-remote-vulnerability
Show 15 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=284511
lighttpd.net/assets/2007/9/9/lighttpd_sa_2007_12.txt
exchange.xforce.ibmcloud.com/vulnerabilities/36526
securityreason.com/securityalert/3127
trac.lighttpd.net/trac/changeset/1986
vupen.com/english/advisories/2007/3110
novell.com/linux/security/advisories/2007_20_sr.html
nvd.nist.gov/vuln/detail/CVE-2007-4727
github.com/advisories/GHSA-8fr6-p7rj-wmfr
security-tracker.debian.org/tracker/CVE-2007-4727