CVSS: 7.6EPSS: 3%CPEs: 39EXPL: 1CVE-2013-7456 – gd: incorrect boundary adjustment in _gdContributionsCalc
https://notcve.org/view.php?id=CVE-2013-7456
27 May 2016 — gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function. gd_interpolation.c en la GD Graphics Library (también conocido como libgd) en versiones anteriores a 2.1.1, tal como se usa en PHP en versiones anteriores 5.5.36, 5.6.x en versiones an... • http://php.net/ChangeLog-5.php • CWE-125: Out-of-bounds Read •
CVSS: 8.6EPSS: 4%CPEs: 31EXPL: 0CVE-2016-5094 – php: Integer overflow in php_html_entities()
https://notcve.org/view.php?id=CVE-2016-5094
27 May 2016 — Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function. Desbordamiento de entero en la función php_html_entities en ext/standard/html.c en PHP en versiones anteriores a 5.5.36 y 5.6.x en versiones anteriores a 5.6.22 permite a atacantes remotos provocar una denegación de servicio o... • http://php.net/ChangeLog-5.php • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.6EPSS: 6%CPEs: 31EXPL: 1CVE-2016-5096 – php: Integer underflow causing arbitrary null write in fread/gzread
https://notcve.org/view.php?id=CVE-2016-5096
27 May 2016 — Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument. Desbordamiento de entero en la función fread en ext/standard/file.c en PHP en versiones anteriores a 5.5.36 y 5.6.x en versiones anteriores a 5.6.22 permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a t... • http://php.net/ChangeLog-5.php • CWE-190: Integer Overflow or Wraparound •
CVSS: 8.6EPSS: 2%CPEs: 38EXPL: 1CVE-2016-5093 – php: improper nul termination leading to out-of-bounds read in get_icu_value_internal
https://notcve.org/view.php?id=CVE-2016-5093
27 May 2016 — The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call. La función get_icu_value_internal en ext/intl/locale/locale_methods.c en PHP en versiones anteriores a 5.5.36, 5.6.x en versiones anteriores a 5.6.22 y 7.x ... • http://php.net/ChangeLog-5.php • CWE-125: Out-of-bounds Read CWE-170: Improper Null Termination •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2015-8879 – php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns
https://notcve.org/view.php?id=CVE-2015-8879
22 May 2016 — The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table. La función odbc_bindcols en ext/odbc/php_odbc.c en PHP en versiones anteriores a 5.6.12 no maneja correctamente el comportamiento del controlador para columnas SQL_WVARCHA... • http://rhn.redhat.com/errata/RHSA-2016-2750.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2015-8867 – php: openssl_random_pseudo_bytes() is not cryptographically secure
https://notcve.org/view.php?id=CVE-2015-8867
22 May 2016 — The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. La función openssl_random_pseudo_bytes en ext/openssl/openssl.c en PHP en versiones anteriores a 5.4.44, 5.5.x en versiones anteriores a 5.5.28 y 5.6.x en versiones anteriores a 5.6.12 se basa incorre... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=16023f3e3b9c06cf677c3c980e8d574e4c162827 • CWE-310: Cryptographic Issues •
CVSS: 9.8EPSS: 6%CPEs: 3EXPL: 1CVE-2015-8876 – php: Zend/zend_exceptions.c does not validate certain Exception objects
https://notcve.org/view.php?id=CVE-2015-8876
22 May 2016 — Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data. Zend/zend_exceptions.c en PHP en versiones anteriores a 5.4.44, 5.5.x en versiones anteriores a 5.5.28 y 5.6.x en versiones anteriores a 5.6.12 no valida ciertos objetos Exception, lo que permite ataca... • http://rhn.redhat.com/errata/RHSA-2016-2750.html • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 6%CPEs: 2EXPL: 1CVE-2015-8877 – gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches
https://notcve.org/view.php?id=CVE-2015-8877
22 May 2016 — The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function. La función gdImageScaleTwoPass en gd_interpolation.c en el GD Graphics Library (también conocido como libgd) en versiones anteriores a 2.2.0, como es utilizado en PHP e... • http://rhn.redhat.com/errata/RHSA-2016-2750.html • CWE-399: Resource Management Errors CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 9.8EPSS: 3%CPEs: 30EXPL: 1CVE-2016-4537 – php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition
https://notcve.org/view.php?id=CVE-2016-4537
22 May 2016 — The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call. La función bcpowmod en ext/bcmath/bcmath.c en PHP en versiones anteriores a 5.5.35, 5.6.x en versiones anteriores a 5.6.21 y 7.x en versiones anteriores a 7.0.6 acepta un entero negativo para el argumento escala, lo que permite a a... • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html • CWE-20: Improper Input Validation CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 3%CPEs: 30EXPL: 1CVE-2016-4538 – php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition
https://notcve.org/view.php?id=CVE-2016-4538
22 May 2016 — The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call. La función bcpowmod en ext/bcmath/bcmath.c en PHP en versiones anteriores a 5.5.35, 5.6.x en versiones anteriores a 5.6.21 y 7.x en versiones anteriores a 7.... • http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183736.html • CWE-20: Improper Input Validation CWE-122: Heap-based Buffer Overflow •