CVE-2015-4148

php: SoapClient's do_soap_call() type confusion after unserialize()

The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.

CVSS 2.0 · 5.0 Medium EPSS 19.8% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-4599

php: type confusion issue in unserialize() with various SOAP methods

The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2015-2301

php: use after free in phar_object.c

Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVSS 2.0 · 7.5 High EPSS 14.7% KEV · Not listed

Vendors

Apple Canonical Debian and 3 more

Products

Mac Os X Ubuntu Linux Debian Linux and 10 more

CVE-2015-1863

wpa_supplicant: P2P SSID processing vulnerability

Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries.

CVSS 2.0 · 5.8 Medium EPSS 5.2% KEV · Not listed

Vendors

Canonical Debian Opensuse and 2 more

Products

Ubuntu Linux Debian Linux Opensuse and 8 more

CVE-2014-8136

libvirt: local denial of service in qemu/qemu_driver.c

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Canonical Mageia Opensuse and 1 more

Products

Ubuntu Linux Mageia Opensuse and 7 more

CVE-2015-0432

mysql: unspecified vulnerability related to Server:InnoDB:DDL:Foreign Key (CPU Jan 2015)

Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key.

CVSS 2.0 · 4.0 Medium EPSS 4.0% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 14 more

CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed

Vendors

Apple Opensuse Php and 1 more

Products

Mac Os X Opensuse Php and 8 more

CVE-2015-2783

php: buffer over-read in Phar metadata parsing

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

CVSS 2.0 · 5.8 Medium EPSS 9.0% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-2787

php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

CVSS 2.0 · 7.5 High EPSS 11.8% KEV · Not listed

Vendors

Apple Opensuse Php and 1 more

Products

Mac Os X Opensuse Php and 8 more

CVE-2015-0251

subversion: (mod_dav_svn) spoofing svn:author property values for new revisions

The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.

CVSS 2.0 · 4.0 Medium EPSS 7.9% KEV · Not listed

Vendors

Apache Apple Opensuse and 2 more

Products

Subversion Xcode Opensuse and 7 more

CVE-2015-3247

spice: memory corruption in worker_update_monitors_config()

Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.

CVSS 2.0 · 6.9 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat Spice Project

Products

Enterprise Linux Enterprise Linux Desktop Enterprise Linux Hpc Node and 3 more

CVE-2015-3276

openldap: incorrect multi-keyword mode cipherstring parsing

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

CVSS 3.1 · 7.5 High EPSS 5.3% KEV · Not listed

Vendors

Openldap Oracle Redhat

Products

Openldap Linux Enterprise Linux and 7 more

CVE-2015-3307

php: invalid pointer free() in phar_tar_process_metadata()

The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

CVSS 2.0 · 7.5 High EPSS 6.7% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2014-8108

subversion: NULL pointer dereference flaw in mod_dav_svn when handling URIs for virtual transaction names

The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 10.0% KEV · Not listed

Vendors

Apache Apple Redhat

Products

Subversion Xcode Enterprise Linux and 4 more

CVE-2015-3329

php: buffer overflow in phar_set_inode()

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

CVSS 2.0 · 7.5 High EPSS 38.2% KEV · Not listed

Vendors

Apple Oracle Php and 1 more

Products

Mac Os X Linux Solaris and 9 more

CVE-2015-3330

php: pipelined request executed in deinitialized interpreter under httpd 2.4

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

CVSS 2.0 · 6.8 Medium EPSS 13.5% KEV · Not listed

Vendors

Apple Oracle Php and 1 more

Products

Mac Os X Linux Solaris and 9 more

CVE-2015-3411

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2015-3412

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.

CVSS 3.0 · 5.3 Medium EPSS 3.9% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux Enterprise Linux Desktop and 6 more

CVE-2015-4021

php: memory corruption in phar_parse_tarfile caused by empty entry file name

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

CVSS 2.0 · 5.0 Medium EPSS 20.5% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more

CVE-2015-4026

php: pcntl_exec() accepts paths with NUL character

The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 18.8% KEV · Not listed

Vendors

Apple Php Redhat

Products

Mac Os X Php Enterprise Linux and 7 more