Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2015-8394

pcre: Integer overflow caused by missing check for certain conditions (8.38/31)

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Pcre Php
Products
Perl Compatible Regular Expression Library Php
CVE-2015-8616

php: Use after free vulnerability in Collator::sortWithSortKeys

Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.

CVSS 3.0 · 8.6 High EPSS 2.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2015-8617

php: Format string vulnerability in class name error message

Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.

CVSS 3.0 · 9.8 Critical EPSS 22.8% KEV · Not listed
Vendors
Php
Products
Php
CVE-2015-8835

php: type confusion issue in Soap Client call() method

The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.

CVSS 3.0 · 9.8 Critical EPSS 6.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8838

php: mysqlnd interface vulnerable to BACKRONYM

ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.

CVSS 3.0 · 5.9 Medium EPSS 1.7% KEV · Not listed
Vendors
Php
Products
Php
CVE-2015-8865

file: Buffer over-write in finfo_open with malformed magic file

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

CVSS 3.0 · 7.3 High EPSS 5.5% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Rhel Software Collections
CVE-2015-8866

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

CVSS 3.1 · 9.6 Critical EPSS 4.2% KEV · Not listed
Vendors
Canonical Opensuse Php and 2 more
Products
Ubuntu Linux Leap Opensuse and 4 more
CVE-2015-8867

php: openssl_random_pseudo_bytes() is not cryptographically secure

The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

CVSS 3.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Rhel Software Collections
CVE-2015-8873

php: Stack consumption vulnerability in Zend/zend_exceptions.c

Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.

CVSS 3.1 · 7.5 High EPSS 3.8% KEV · Not listed
Vendors
Opensuse Php Redhat
Products
Leap Php Rhel Software Collections
CVE-2015-8874

gd: gdImageFillToBorder deep recursion leading to stack overflow

Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.

CVSS 3.0 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Opensuse Php Redhat
Products
Leap Php Rhel Software Collections
CVE-2015-8876

php: Zend/zend_exceptions.c does not validate certain Exception objects

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

CVSS 3.0 · 9.8 Critical EPSS 7.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8877

gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches

The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.

CVSS 3.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Libgd Php Redhat
Products
Libgd Php Rhel Software Collections
CVE-2015-8878

php: main/php_open_temporary_file.c does not ensure thread safety

main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.

CVSS 3.0 · 5.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Php
Products
Php
CVE-2015-8879

php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns

The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2015-8880

php: Double free vulnerability in error condition of format printer

Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Php
Products
Php
CVE-2015-8935

php: HTTP response splitting in header() function

The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.

CVSS 3.0 · 6.1 Medium EPSS 3.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-1283

pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)

The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/ pattern and related patterns with named subgroups, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

CVSS 3.1 · 9.8 Critical EPSS 7.8% KEV · Not listed
Vendors
Fedoraproject Oracle Pcre and 2 more
Products
Fedora Solaris Pcre and 2 more
CVE-2016-1903

php: Out-of-bounds memory read via gdImageRotateInterpolated

The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.

CVSS 3.0 · 9.1 Critical EPSS 7.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections
CVE-2016-1904

php: heap buffer overflow in escapeshell functions

Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.

CVSS 3.0 · 7.3 High EPSS 2.7% KEV · Not listed
Vendors
Php
Products
Php
CVE-2016-2554

php: buffer overflow in handling of long link names in tar phar archives

Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.

CVSS 3.0 · 9.8 Critical EPSS 11.0% KEV · Not listed
Vendors
Php Redhat
Products
Php Rhel Software Collections