CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 1CVE-2016-7125 – php: Session Data Injection Vulnerability
https://notcve.org/view.php?id=CVE-2016-7125
10 Sep 2016 — ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection. ext/session/session.c en PHP en versiones anteriores a 5.6.25 y 7.x en versiones anteriores a 7.0.10 omite nombres de sesión no válidos de una manera que desencadena un análisis gramatical incorrecto, lo que permite a atacantes rem... • http://openwall.com/lists/oss-security/2016/09/02/9 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 2%CPEs: 11EXPL: 1CVE-2016-7126 – php: select_colors write out-of-bounds
https://notcve.org/view.php?id=CVE-2016-7126
10 Sep 2016 — The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument. La función imagetruecolortopalette en ext/gd/gd.c en PHP en versiones anteriores a 5.6.25 y 7.x en versiones anteriores a 7.0.10 no valida adecuadamente el número de col... • http://openwall.com/lists/oss-security/2016/09/02/9 • CWE-787: Out-of-bounds Write •
CVSS: 5.3EPSS: 0%CPEs: 11EXPL: 1CVE-2016-7128 – php: Memory Leakage In exif_process_IFD_in_TIFF
https://notcve.org/view.php?id=CVE-2016-7128
10 Sep 2016 — The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image. La función exif_process_IFD_in_TIFF en ext/exif/exif.c en PHP en versiones anteriores a 5.6.25 y 7.x en versiones anteriores a 7.0.10 no maneja correctamente el caso de desplazamientos en miniatura que exceden el tamaño de archivo, lo... • http://openwall.com/lists/oss-security/2016/09/02/9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 1%CPEs: 10EXPL: 1CVE-2016-7133 – Ubuntu Security Notice USN-3095-1
https://notcve.org/view.php?id=CVE-2016-7133
10 Sep 2016 — Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname. Zend/zend_alloc.c en PHP 7.x en versiones anteriores a 7.0.10, cuando la apertura de open_basedir está habilitada, no maneja adecuadamente operaciones de realloc enormes, lo que permite a atacantes remotos provocar una denegación de servicio (desbordamiento de ... • http://openwall.com/lists/oss-security/2016/09/02/9 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 1CVE-2016-7130 – php: wddx_deserialize null dereference
https://notcve.org/view.php?id=CVE-2016-7130
10 Sep 2016 — The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document. La función php_wddx_pop_element en ext/wddx/wddx.c en PHP en versiones anteriores a 5.6.25 y 7.x en versiones anteriores a 7.0.10 ... • http://openwall.com/lists/oss-security/2016/09/02/9 • CWE-476: NULL Pointer Dereference •
CVSS: 9.1EPSS: 0%CPEs: 28EXPL: 1CVE-2016-5114 – php: out-of-bounds write in fpm_log.c
https://notcve.org/view.php?id=CVE-2016-5114
02 Aug 2016 — sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and buffer overflow) via a long string, as demonstrated by a long URI in a configuration with custom REQUEST_URI logging. sapi/fpm/fpm/fpm_log.c en PHP en versiones anteriores a 5.5.31, 5.6.x en versiones anteriores a 5.6.17 y 7.x en versiones... • http://github.com/php/php-src/commit/2721a0148649e07ed74468f097a28899741eb58f?w=1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 4%CPEs: 40EXPL: 1CVE-2016-6292 – php: Null pointer dereference in exif_process_user_comment
https://notcve.org/view.php?id=CVE-2016-6292
25 Jul 2016 — The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image. La función exif_process_user_comment en ext/exif/exif.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24 y 7.x en versiones anteriores a 7.0.9 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NU... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=41131cd41d2fd2e0c2f332a27988df75659c42e4 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 40EXPL: 1CVE-2016-6289 – php: Integer overflow leads to buffer overflow in virtual_file_ex
https://notcve.org/view.php?id=CVE-2016-6289
25 Jul 2016 — Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive. Desbordamiento de entero en la función virtual_file_ex en TSRM/tsrm_virtual_cwd.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24 y 7.x en versiones anteriores a 7.0... • http://fortiguard.com/advisory/fortinet-discovers-php-stack-based-buffer-overflow-vulnerabilities • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 2%CPEs: 40EXPL: 0CVE-2016-6290 – php: Use after free in unserialize() with Unexpected Session Deserialization
https://notcve.org/view.php?id=CVE-2016-6290
25 Jul 2016 — ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization. ext/session/session.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24 y 7.x en versiones anteriores a 7.0.9 no mantiene correctamente una determinada estructura de datos ... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=3798eb6fd5dddb211b01d41495072fd9858d4e32 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 42EXPL: 1CVE-2016-6297 – php: Stack-based buffer overflow vulnerability in php_stream_zip_opener
https://notcve.org/view.php?id=CVE-2016-6297
25 Jul 2016 — Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL. Desbordamiento de entero en la función php_stream_zip_opener en ext/zip/zip_stream.c en PHP en versiones anteriores a 5.5.38, 5.6.x en versiones anteriores a 5.6.24 y 7.x en versiones anteriores a 7.0.9 permite a ataca... • http://fortiguard.com/advisory/fortinet-discovers-php-stack-based-buffer-overflow-vulnerabilities • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •