Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2017-11147

php: Out-of-bounds read in phar_parse_pharfile

In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

CVSS 3.1 · 9.1 Critical EPSS 4.7% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Clustered Data Ontap Php Rhel Software Collections
CVE-2017-11362

php: Stack-based buffer over-read in msgfmt_parse_message function

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact within International Components for Unicode (ICU) for C/C++ via a long first argument to the msgfmt_parse_message function.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2017-11628

php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives.

CVSS 3.0 · 7.8 High EPSS 3.4% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2017-5340

php: Use of uninitialized memory in unserialize()

Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.

CVSS 3.1 · 9.8 Critical EPSS 16.7% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Clustered Data Ontap Php Rhel Software Collections
CVE-2017-11142

php: Denial-of-Service via injecting long form variables

In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.

CVSS 3.0 · 7.5 High EPSS 8.3% KEV · Not listed
Vendors
Php
Products
Php
CVE-2017-11143

php: Incorrect WDDX deserialization of boolean parameters leads to DoS

In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.

CVSS 3.0 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7480

php: Use of uninitialized value in SplObjectStorag::unserialize

The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.

CVSS 3.1 · 9.8 Critical EPSS 41.6% KEV · Not listed
Vendors
Netapp Php
Products
Clustered Data Ontap Php
CVE-2017-11144

php: Incorrect return value check of OpenSSL sealing function leads to crash

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission.

CVSS 3.0 · 7.5 High EPSS 6.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-7478

php: Unserialize Exception object can lead to infinite loop

Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

CVSS 3.0 · 7.5 High EPSS 42.4% KEV · Not listed
Vendors
Php
Products
Php
CVE-2016-7479

php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object

In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 41.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2017-11145

php: wddx_deserialize() heap out-of-bound read via php_parse_date()

In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2017-6441

php: Null pointer dereference via crafted "declare(ticks="

The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only.

CVSS 3.0 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Php
Products
Php
CVE-2016-10162

php: Null pointer dereference when unserializing PHP object

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.

CVSS 3.0 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-10161

php: Out-of-bounds heap read on unserialize in finish_nested_data()

The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.

CVSS 3.0 · 7.5 High EPSS 13.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-10397

php: Incorrect handling of URI components in URL parser

In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c).

CVSS 3.0 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Php
Products
Php
CVE-2016-10160

php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

CVSS 3.1 · 9.8 Critical EPSS 7.4% KEV · Not listed
Vendors
Debian Netapp Php and 1 more
Products
Debian Linux Clustered Data Ontap Php and 1 more
CVE-2015-8994

php: Zend OPCache code permission/sensitive data protection issues

An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Php
Products
Php
CVE-2016-10158

php: Wrong calculation in exif_convert_any_to_int function

The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

CVSS 3.0 · 7.5 High EPSS 7.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-10159

php: Integer overflow in phar_parse_pharfile

Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.

CVSS 3.1 · 7.5 High EPSS 7.6% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Rhel Software Collections