CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2015-8994
https://notcve.org/view.php?id=CVE-2015-8994
An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). • http://marc.info/?l=php-internals&m=147876797317925&w=2 http://marc.info/?l=php-internals&m=147921016724565&w=2 http://openwall.com/lists/oss-security/2017/02/28/1 http://seclists.org/oss-sec/2016/q4/343 http://seclists.org/oss-sec/2017/q1/520 https://bugs.php.net/bug.php?id=69090 https://ma.ttias.be/a-better-way-to-run-php-fpm • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 4%CPEs: 17EXPL: 0CVE-2016-10158 – php: Wrong calculation in exif_convert_any_to_int function
https://notcve.org/view.php?id=CVE-2016-10158
The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1. La función exif_convert_any_to_int en ext/exif/exif.c en PHP en versiones anteriores a 5.6.30, 7.0.x en versiones anteriores a 7.0.15, y 7.1.x en versiones anteriores a 7.1.1 permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) a través de datos EXIF manipulados que desencadenan un intento de dividir el entero negativo mínimo representable por -1. It was found that the exif_convert_any_to_int() function in PHP was vulnerable to floating point exceptions when parsing tags in image files. A remote attacker with the ability to upload a malicious image could crash PHP, causing a Denial of Service. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.debian.org/security/2017/dsa-3783 http://www.securityfocus.com/bid/95764 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73737 https://github.com/php/php-src/commit/1cda0d7c2ffb62d8331c64e703131d9cabdc03ea https://security.gentoo.org/glsa/201702-29 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.tenable.co • CWE-189: Numeric Errors CWE-682: Incorrect Calculation •
CVSS: 7.5EPSS: 58%CPEs: 4EXPL: 0CVE-2016-10159 – php: Integer overflow in phar_parse_pharfile
https://notcve.org/view.php?id=CVE-2016-10159
Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive. Desbordamiento de entero en la función phar_parse_pharfile en ext/phar/phar.c en PHP en versiones anteriores a 5.6.30 y 7.0.x en versiones anteriores a 7.0.15 permite a atacantes remotos provocar una denegación de servicio (consumo de memoria o caída de aplicación) a través de una entrada de manifiesto truncado en un archivo PHAR. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.debian.org/security/2017/dsa-3783 http://www.securityfocus.com/bid/95774 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73764 https://github.com/php/php-src/commit/ca46d0acbce55019b970fcd4c1e8a10edfdded93 https://security.gentoo.org/glsa/201702-29 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.tenable.co • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 3%CPEs: 17EXPL: 0CVE-2016-10161 – php: Out-of-bounds heap read on unserialize in finish_nested_data()
https://notcve.org/view.php?id=CVE-2016-10161
The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. La función object_common1 en ext/standard/var_unserializer.c en PHP en versiones anteriores a 5.6.30, 7.0.x en versiones anteriores a 7.0.15 y 7.1.x en versiones anteriores a 7.1.1 permite a atacantes remotos provocar una denegación de servicio (sobre lectura de búfer y caída de aplicación) a través de datos serializados manipulados que se maneja mal en una llamada finish_nested_data. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.debian.org/security/2017/dsa-3783 http://www.securityfocus.com/bid/95768 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73825 https://github.com/php/php-src/commit/16b3003ffc6393e250f069aa28a78dc5a2c064b2 https://security.gentoo.org/glsa/201702-29 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.tenable.co • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 9%CPEs: 202EXPL: 1CVE-2016-7478
https://notcve.org/view.php?id=CVE-2016-7478
Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876. cccZend/zend_exceptions.c en PHP, posiblemente en 5.x en versiones anteriores a 5.6.28 y 7.x en versiones anteriores a 7.0.13, permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de un objeto Exception manipulado en datos serializados, un caso relacionado con CVE-2015-8876. • http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7 http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf http://www.securityfocus.com/bid/95150 https://bugs.php.net/bug.php?id=73093 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.youtube.com/watch?v=LDcaPstAuPk •