Export limit exceeded: 18254 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2015-0232

php: Free called on unitialized pointer in exif.c

The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

CVSS 2.0 · 6.8 Medium EPSS 15.6% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2015-0235

glibc: __nss_hostname_digits_dots() heap-based buffer overflow

Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

CVSS 2.0 · 10.0 Critical EPSS 94.6% KEV · Not listed
Vendors
Apple Debian Gnu and 4 more
Products
Mac Os X Debian Linux Glibc and 19 more
CVE-2015-0273

php: use after free vulnerability in unserialize() with DateTimeZone

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the php_date_initialize_from_hash function.

CVSS 2.0 · 7.5 High EPSS 42.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections
CVE-2015-1351

php: use after free in opcache extension

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

CVSS 2.0 · 7.5 High EPSS 8.3% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Secure Backup and 3 more
CVE-2015-1352

php: NULL pointer dereference in pgsql extension

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

CVSS 2.0 · 5.0 Medium EPSS 6.6% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Rhel Software Collections
CVE-2015-2301

php: use after free in phar_object.c

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS 2.0 · 7.5 High EPSS 14.7% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Ubuntu Linux Debian Linux and 10 more
CVE-2015-2305

regex: heap overflow in regcomp() on 32-bit architectures

Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.

CVSS 2.0 · 6.8 Medium EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Opensuse and 3 more
Products
Ubuntu Linux Debian Linux Opensuse and 3 more
CVE-2015-2331

libzip: integer overflow when processing ZIP archives

Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed
Vendors
Debian Fedoraproject Nih and 2 more
Products
Debian Linux Fedora Libzip and 2 more
CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2015-2783

php: buffer over-read in Phar metadata parsing

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

CVSS 2.0 · 5.8 Medium EPSS 9.0% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-2787

php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

CVSS 2.0 · 7.5 High EPSS 11.8% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2015-3152

mysql: use of SSL/TLS can not be enforced in mysql client library (oCERT-2015-003, BACKRONYM)

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

CVSS 3.1 · 5.9 Medium EPSS 7.1% KEV · Not listed
Vendors
Debian Fedoraproject Mariadb and 3 more
Products
Debian Linux Fedora Mariadb and 11 more
CVE-2015-3307

php: invalid pointer free() in phar_tar_process_metadata()

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

CVSS 2.0 · 7.5 High EPSS 6.7% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-3329

php: buffer overflow in phar_set_inode()

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

CVSS 2.0 · 7.5 High EPSS 38.2% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-3330

php: pipelined request executed in deinitialized interpreter under httpd 2.4

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

CVSS 2.0 · 6.8 Medium EPSS 13.5% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-3411

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-3412

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-3414

sqlite: use of uninitialized memory when parsing collation sequences in src/where.c

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Watchos Ubuntu Linux and 4 more
CVE-2015-3415

sqlite: invalid free() in src/vdbe.c

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.

CVSS 2.0 · 7.5 High EPSS 4.1% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Watchos Ubuntu Linux and 4 more
CVE-2015-3416

sqlite: stack buffer overflow in src/printf.c

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

CVSS 2.0 · 7.5 High EPSS 5.4% KEV · Not listed
Vendors
Apple Canonical Debian and 3 more
Products
Mac Os X Watchos Ubuntu Linux and 4 more