Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2007-2727 Details

Description

The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html	CVE	Vendor Advisory
http://bugs.php.net/bug.php?id=40999	CVE	Vendor Advisory
http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10	CVE	Vendor Advisory
http://osvdb.org/36087	CVE	Broken Link
http://secunia.com/advisories/26895	CVE	Broken Link
http://www.fortheloot.com/public/mcrypt.patch	CVE	ExploitPatchThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187	CVE	Broken Link
http://www.novell.com/linux/security/advisories/2007_15_sr.html	CVE	Third Party Advisory
http://www.php.net/ChangeLog-5.php	CVE	Vendor Advisory
http://www.securityfocus.com/bid/23984	CVE	Third Party AdvisoryVDB Entry
http://blog.php-security.org/archives/80-Watching-the-PHP-CVS.html	[email protected]	Vendor Advisory
http://bugs.php.net/bug.php?id=40999	[email protected]	Vendor Advisory
http://cvs.php.net/viewvc.cgi/php-src/ext/mcrypt/mcrypt.c?r1=1.91.2.3.2.9&r2=1.91.2.3.2.10	[email protected]	Vendor Advisory
http://osvdb.org/36087	[email protected]	Broken Link
http://secunia.com/advisories/26895	[email protected]	Broken Link
http://www.fortheloot.com/public/mcrypt.patch	[email protected]	ExploitPatchThird Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:187	[email protected]	Broken Link
http://www.novell.com/linux/security/advisories/2007_15_sr.html	[email protected]	Third Party Advisory
http://www.php.net/ChangeLog-5.php	[email protected]	Vendor Advisory
http://www.securityfocus.com/bid/23984	[email protected]	Third Party AdvisoryVDB Entry

see all 20 references

Weakness Enumeration

CWE-ID	CWE Name	Source
NVD-CWE-Other	Weakness Not in a Standard CWE Category	[email protected]

Affected Products

Product	Versions
php php	>= 4.4.0, < 4.4.7 >= 5.0.0, < 5.2.2 4.0.1 4.0.1 patch1 4.0.1 patch2
CPE cpe:2.3:a:php:php:::::::: cpe:2.3:a:php:php:4.0.1:::::::* cpe:2.3:a:php:php:4.0.1:patch1:::::: cpe:2.3:a:php:php:4.0.1:patch2:::::: cpe:2.3:a:php:php:4.0.2:::::::* cpe:2.3:a:php:php:4.0.3:::::::* cpe:2.3:a:php:php:4.0.3:patch1:::::: cpe:2.3:a:php:php:4.0.4:::::::* cpe:2.3:a:php:php:4.0.5:::::::* cpe:2.3:a:php:php:4.0.6:::::::* cpe:2.3:a:php:php:4.0.7:::::::* cpe:2.3:a:php:php:4.0.7:rc1:::::: cpe:2.3:a:php:php:4.0.7:rc2:::::: cpe:2.3:a:php:php:4.0.7:rc3:::::: cpe:2.3:a:php:php:4.1.0:::::::* cpe:2.3:a:php:php:4.1.1:::::::* cpe:2.3:a:php:php:4.1.2:::::::* cpe:2.3:a:php:php:4.2.0:::::::* cpe:2.3:a:php:php:4.2.1:::::::* cpe:2.3:a:php:php:4.2.2:::::::* cpe:2.3:a:php:php:4.2.3:::::::* cpe:2.3:a:php:php:4.3.0:::::::* cpe:2.3:a:php:php:4.3.1:::::::* cpe:2.3:a:php:php:4.3.2:::::::* cpe:2.3:a:php:php:4.3.3:::::::* cpe:2.3:a:php:php:4.3.4:::::::* cpe:2.3:a:php:php:4.3.5:::::::* cpe:2.3:a:php:php:4.3.6:::::::* cpe:2.3:a:php:php:4.3.7:::::::* cpe:2.3:a:php:php:4.3.8:::::::* cpe:2.3:a:php:php:4.3.9:::::::* cpe:2.3:a:php:php:4.3.10:::::::* cpe:2.3:a:php:php:4.3.11:::::::* Remediation No remediation found in references.

Product

Versions

php php

>= 4.4.0, < 4.4.7

>= 5.0.0, < 5.2.2

4.0.1

4.0.1 patch1

4.0.1 patch2

CPE

cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.1:patch2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.3:patch1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc1:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc2:*:*:*:*:*:*
cpe:2.3:a:php:php:4.0.7:rc3:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.0:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.1:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.2:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.3:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.4:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.5:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.6:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.7:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.8:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.9:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.10:*:*:*:*:*:*:*
cpe:2.3:a:php:php:4.3.11:*:*:*:*:*:*:*

Remediation

No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2022	Modified Analysis	[email protected]
Oct 30, 2018	CPE Deprecation Remap	[email protected]
May 17, 2007	Initial Analysis	[email protected]