Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2010-4409

php: getSymbol() integer overflow vulnerability

Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument.

CVSS 2.0 · 5.0 Medium EPSS 18.9% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-4156

php information disclosure via mb_strcut()

The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).

CVSS 2.0 · 5.0 Medium EPSS 12.8% KEV · Not listed
Vendors
Php Redhat Scottmac
Products
Php Enterprise Linux Libmbfl
CVE-2010-4150

php: Double free in the imap extension

Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 6.3% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-3870

php: XSS mitigation bypass via utf8_decode()

The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string.

CVSS 2.0 · 6.8 Medium EPSS 11.3% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux
CVE-2010-3710

php: DoS in filter_var() via long email string

Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.

CVSS 2.0 · 4.3 Medium EPSS 3.1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2010-3709

php: NULL pointer dereference in ZipArchive::getArchiveComment

The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.

CVSS 2.0 · 4.3 Medium EPSS 13.3% KEV · Not listed
Vendors
Canonical Php Redhat
Products
Ubuntu Linux Php Enterprise Linux
CVE-2010-3436

php: open_basedir bypass via fopen_wrappers.c

fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.

CVSS 2.0 · 5.0 Medium EPSS 6.3% KEV · Not listed
Vendors
Canonical Php
Products
Ubuntu Linux Php
CVE-2010-3065

php: session serializer session data injection vulnerability (MOPS-2010-060)

The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

CVSS 2.0 · 5.0 Medium EPSS 2.5% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2010-3064

php: mysqlnd: multiple buffer overflows (MOPS-2010-05[789])

Stack-based buffer overflow in the php_mysqlnd_auth_write function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument to the (a) mysql_connect or (b) mysqli_connect function.

CVSS 2.0 · 6.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-3063

php: mysqlnd: multiple buffer overflows (MOPS-2010-05[789])

The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.

CVSS 2.0 · 5.0 Medium EPSS 1.6% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-3062

php: mysqlnd: php_mysqlnd_ok_read() information leak (MOPS-2010-056)

mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the php_mysqlnd_ok_read function; or (2) trigger a heap-based buffer overflow via a modified length value, which is not properly handled by the php_mysqlnd_rset_header_read function.

CVSS 2.0 · 5.0 Medium EPSS 2.6% KEV · Not listed
Vendors
Php
Products
Php
CVE-2010-2950

php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

CVSS 2.0 · 6.8 Medium EPSS 5.7% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2010-2531

php: information leak vulnerability in var_export()

The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if display_errors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion.

CVSS 2.0 · 4.3 Medium EPSS 5.0% KEV · Not listed
Vendors
Debian Php Redhat
Products
Debian Linux Php Enterprise Linux
CVE-2024-2408

PHP is vulnerable to the Marvin Attack

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.

CVSS 3.1 · 5.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Fedoraproject Php Redhat
Products
Fedora Php Enterprise Linux
CVE-2023-0662

DoS vulnerability when parsing multipart request body

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2023-0568

Array overrun in common path resolve code

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2024-5585

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

CVSS 3.1 · 7.7 High EPSS 28.8% KEV · Not listed
Vendors
Fedoraproject Php
Products
Fedora Php
CVE-2023-3824

Buffer overflow and overread in phar_dir_read()

In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

CVSS 3.1 · 9.4 Critical EPSS 21.8% KEV · Not listed
Vendors
Debian Fedoraproject Php and 1 more
Products
Debian Linux Fedora Php and 1 more
CVE-2023-3823

Security issue with external entity loading in XML without enabling it

In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.

CVSS 3.1 · 8.6 High EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Php and 1 more
Products
Debian Linux Fedora Php and 1 more
CVE-2024-25117

php-svg-lib lacks path validation on font through SVG inline styles

php-svg-lib is a scalable vector graphics (SVG) file parsing/rendering library. Prior to version 0.5.2, php-svg-lib fails to validate that font-family doesn't contain a PHAR url, which might leads to RCE on PHP < 8.0, and doesn't validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib. The `Style::fromAttributes(`), or the `Style::parseCssStyle()` should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the `Style::fromStyleSheets` might be reused. Libraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even remote code execution, if they do not double check the value of the `fontName` that is passed by php-svg-lib. Version 0.5.2 contains a fix for this issue.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dompdf Php
Products
Php-svg-lib Php