CVE-2016-4540

php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used

The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed

Vendors

Fedoraproject Opensuse Php and 1 more

Products

Fedora Leap Php and 1 more

CVE-2016-4541

php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used

The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed

Vendors

Fedoraproject Opensuse Php and 1 more

Products

Fedora Leap Php and 1 more

CVE-2016-4542

php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input

The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

CVSS 3.0 · 9.8 Critical EPSS 6.1% KEV · Not listed

Vendors

Fedoraproject Opensuse Php and 1 more

Products

Fedora Leap Php and 1 more

CVE-2016-4543

php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

CVSS 3.0 · 9.8 Critical EPSS 11.9% KEV · Not listed

Vendors

Fedoraproject Hp Opensuse and 2 more

Products

Fedora System Management Homepage Leap and 2 more

CVE-2016-4544

php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input

The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

CVSS 3.1 · 9.8 Critical EPSS 6.5% KEV · Not listed

Vendors

Debian Fedoraproject Opensuse and 2 more

Products

Debian Linux Fedora Leap and 3 more

CVE-2016-5093

php: improper nul termination leading to out-of-bounds read in get_icu_value_internal

The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.

CVSS 3.0 · 8.6 High EPSS 5.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections

CVE-2016-5094

php: Integer overflow in php_html_entities()

Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.

CVSS 3.0 · 8.6 High EPSS 4.5% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections

CVE-2016-5095

php: Integer overflow in php_filter_full_special_chars

Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-5094.

CVSS 3.0 · 8.6 High EPSS 2.6% KEV · Not listed

Vendors

Php

Products

Php

CVE-2016-5096

php: Integer underflow causing arbitrary null write in fread/gzread

Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

CVSS 3.0 · 8.6 High EPSS 4.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections

CVE-2016-5114

php: out-of-bounds write in fpm_log.c

sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging.

CVSS 3.0 · 9.1 Critical EPSS 4.5% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections

CVE-2016-5116

gd: Information leak due to stack overflow in gdCtxPrintf

gd_xbm.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in certain custom PHP 5.5.x configurations, allows context-dependent attackers to obtain sensitive information from process memory or cause a denial of service (stack-based buffer under-read and application crash) via a long name.

CVSS 3.0 · 9.1 Critical EPSS 3.8% KEV · Not listed

Vendors

Debian Libgd Opensuse and 1 more

Products

Debian Linux Libgd Leap and 1 more

CVE-2016-5385

PHP: sets environmental variable based on user supplied Proxy request header

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.

CVSS 3.1 · 8.1 High EPSS 50.4% KEV · Not listed

Vendors

Debian Drupal Fedoraproject and 5 more

Products

Debian Linux Drupal Fedora and 13 more

CVE-2016-5766

gd: Integer overflow in _gd2GetHeader() resulting in heap overflow

Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

CVSS 3.0 · 8.8 High EPSS 7.5% KEV · Not listed

Vendors

Debian Fedoraproject Freebsd and 3 more

Products

Debian Linux Fedora Freebsd and 5 more

CVE-2016-5767

gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow

Integer overflow in the gdImageCreate function in gd.c in the GD Graphics Library (aka libgd) before 2.0.34RC1, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted image dimensions.

CVSS 3.0 · 8.8 High EPSS 6.7% KEV · Not listed

Vendors

Libgd Php Redhat

Products

Libgd Php Enterprise Linux and 1 more

CVE-2016-5768

php: Double free in _php_mb_regex_ereg_replace_exec

Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

CVSS 3.0 · 9.8 Critical EPSS 9.6% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Rhel Software Collections

CVE-2016-5769

php: Integer Overflows in mcrypt_generic() and mdecrypt_generic() resulting in heap overflows

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the (1) mcrypt_generic and (2) mdecrypt_generic functions.

CVSS 3.0 · 9.8 Critical EPSS 8.4% KEV · Not listed

Vendors

Php

Products

Php

CVE-2016-5770

php: Int/size_t confusion in SplFileObject::fread

Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.

CVSS 3.1 · 9.8 Critical EPSS 7.3% KEV · Not listed

Vendors

Debian Opensuse Php and 1 more

Products

Debian Linux Leap Opensuse and 2 more

CVE-2016-5771

php: Use After Free Vulnerability in PHP's GC algorithm and unserialize

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.

CVSS 3.1 · 9.8 Critical EPSS 15.5% KEV · Not listed

Vendors

Debian Opensuse Php and 1 more

Products

Debian Linux Leap Opensuse and 2 more

CVE-2016-5772

php: Double Free Corruption in wddx_deserialize

Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

CVSS 3.1 · 9.8 Critical EPSS 9.7% KEV · Not listed

Vendors

Debian Opensuse Php and 2 more

Products

Debian Linux Leap Opensuse and 5 more

CVE-2016-5773

php: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

CVSS 3.0 · 9.8 Critical EPSS 9.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Rhel Software Collections