Servers and applications
CVE-2003-1307
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by…
- Severity
- Medium 4.3
- Published
- 31 Dec 2003
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 17 Oct 2026
- Exploit chance
- 1.7% in the next 30 daysHigher than 77% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Needs local access · Needs a login
- Attacker can
- Read some data · Change some data · Slow it down
- CVSS vector
AV:L/AC:L/Au:S/C:P/I:P/A:P- Sources
- NVD
Description
The mod_php module for the Apache HTTP Server allows local users with write access to PHP scripts to send signals to the server's process group and use the server's file descriptors, as demonstrated by sending a STOP signal, then intercepting incoming connections on the server's TCP port. NOTE: the PHP developer has disputed this vulnerability, saying "The opened file descriptors are opened by Apache. It is the job of Apache to protect them ... Not a bug in PHP.
Affected software
| Software | Affected versions |
|---|---|
Apache HTTP ServerServers and applications · cpe:a:apache:http_server |
All 21 release lines
|