CVE-2010-2094

php: Multiple format string flaws in the phar extension (MOPS-2010-025 MOPS-2010-026 MOPS-2010-027 MOPS-2010-028)

Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.

CVSS 2.0 · 6.8 Medium EPSS 12.7% KEV · Not listed

Vendors

Php

Products

Php

CVE-2012-2376

php: Buffer overflow in com_print_typeinfo() by parsing certain variant types

Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.

CVSS 2.0 · 10.0 Critical EPSS 19.8% KEV · Not listed

Vendors

Microsoft Php

Products

Windows Php

CVE-2010-2093

PHP: Context stream use-after-free on request shutdown (MOPS-2010-022)

Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.

CVSS 2.0 · 5.0 Medium EPSS 1.9% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1917

php: fnmatch long pattern stack memory exhaustion (MOPS-2010-021)

Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2010-1915

php: preg_quote interruption vulnerability (MOPS-2010-017)

The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.

CVSS 2.0 · 5.0 Medium EPSS 1.1% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1914

php: bitwise operators interruption vulnerabilities (MOPS-2010-014, MOPS-2010-015, MOPS-2010-016)

The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZEND_BW_XOR opcode (shift_left_function), (2) ZEND_SL opcode (bitwise_xor_function), or (3) ZEND_SR opcode (shift_right_function), related to the convert_to_long_base function.

CVSS 2.0 · 5.0 Medium EPSS 1.4% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1868

php: sqlite: use of uninitialized memory triggered by empty SQL query (MOPS-2010-012, MOPS-2010-013)

The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query, which triggers access of uninitialized memory.

CVSS 2.0 · 7.5 High EPSS 3.0% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1866

php: dechunk filter integer signedness error causing buffer overflow (MOPS-2010-003)

The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.

CVSS 3.1 · 9.8 Critical EPSS 6.7% KEV · Not listed

Vendors

Opensuse Php Suse

Products

Opensuse Php Linux Enterprise

CVE-2010-1864

php: addcslashes interruption vulnerability (MOPS-2010-006)

The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1862

php: chunk_split interruption vulnerability (MOPS-2010-008)

The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1861

php: shm_put_var interruption vulnerability (MOPS-2010-009)

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed resource.

CVSS 2.0 · 6.4 Medium EPSS 1.0% KEV · Not listed

Vendors

Php

Products

Php

CVE-2006-7243

php: paths with NULL character were considered valid

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function.

CVSS 2.0 · 5.0 Medium EPSS 5.4% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2010-1860

php: html_entity_decode interruption vulnerability (MOPS-2010-010)

The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.

CVSS 2.0 · 5.0 Medium EPSS 1.2% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1130

php: safe_mode / open_basedir security fixes in 5.2.13/5.3.2

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

CVSS 2.0 · 5.0 Medium EPSS 9.5% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1129

php: safe_mode / open_basedir security fixes in 5.2.13/5.3.2

The safe_mode implementation in PHP before 5.2.13 does not properly handle directory pathnames that lack a trailing / (slash) character, which allows context-dependent attackers to bypass intended access restrictions via vectors related to use of the tempnam function.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Php

Products

Php

CVE-2010-1128

php: LCG entropy weakness

The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid function.

CVSS 2.0 · 6.4 Medium EPSS 8.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2010-0397

php: NULL pointer dereference in XML-RPC extension

The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly have unspecified other impact via a crafted argument.

CVSS 2.0 · 5.0 Medium EPSS 11.5% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2009-5016

php: XSS and SQL injection bypass via crafted overlong UTF-8 encoded string

Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.

CVSS 2.0 · 6.8 Medium EPSS 2.7% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2012-2336

php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

CVSS 2.0 · 5.0 Medium EPSS 52.1% KEV · Not listed

Vendors

Php Redhat

Products

Php Enterprise Linux

CVE-2012-2335

php: incomplete CVE-2012-1823 fix - insecure wrapper

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.

CVSS 2.0 · 7.5 High EPSS 33.7% KEV · Not listed

Vendors

Php

Products

Php