Linux Enterprise Module For Web Scripting CVEs and Security Vulnerabilities

CVE-2016-4473

php: Invalid free() instead of efree() in phar_extract_file()

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

CVSS 3.0 · 9.8 Critical EPSS 7.8% KEV · Not listed

Vendors

Php Redhat Suse

Products

Php Rhel Software Collections Linux Enterprise Module For Web Scripting and 1 more

CVE-2015-8866

php: libxml_disable_entity_loader setting is shared between threads

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

CVSS 3.1 · 9.6 Critical EPSS 4.2% KEV · Not listed

Vendors

Canonical Opensuse Php and 2 more

Products

Ubuntu Linux Leap Opensuse and 4 more

Search vulnerabilities

php: Invalid free() instead of efree() in phar_extract_file()

php: libxml_disable_entity_loader setting is shared between threads