CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7963
https://notcve.org/view.php?id=CVE-2017-7963
The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings. NOTE: the vendor disputes this, stating "There is no security issue here, because GMP safely aborts in case of an OOM condition. The only attack vector here is denial of service. However, if you allow attacker-controlled, unbounded allocations you have a DoS vector regardless of GMP's OOM behavior. ** DISPUTADA ** Las interfaces GNU Multiple Precision Arithmetic Library (GMP) para PHP hasta la versión 7.1.4 permiten a atacantes provocar una denegación de servicio (consumo de memoria y caída de aplicación) a través de operaciones en cadenas largas. NOTA: el proveedor se opone a esto, declarando: "No hay ningún problema de seguridad aquí, porque GMP aborta de forma segura en caso de una condición de OOM. • https://bugs.php.net/bug.php?id=74308 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6441
https://notcve.org/view.php?id=CVE-2017-6441
The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of "declare(ticks=" in a PHP script. NOTE: the vendor disputes the classification of this as a vulnerability, stating "Please do not request CVEs for ordinary bugs. CVEs are relevant for security issues only. ** EN DISPUTA ** El _zval_get_long_func_ex en Zend/zend_operators.c en PHP 7.1.2 permite a atacantes provocar una denegación de servicio (referencia al puntero NULL y caída de la aplicación) a través del uso manipulado de "declare(ticks=" en el script PHP. NOTA:El proveedor disputará la clasificación de esto como una vulnerabilidad, declarando: "Por favor, no solicite CVEs para los errores ordinarios. CVEs son relevantes sólo para problemas de seguridad". • https://bugs.php.net/bug.php?id=74146 https://github.com/php/php-src/pull/2396 • CWE-476: NULL Pointer Dereference •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7272
https://notcve.org/view.php?id=CVE-2017-7272
PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained. Because a :port syntax is recognized, fsockopen will use the port number that is specified in the hostname argument, instead of the port number in the second argument of the function. PHP hasta la versión 7.1.11 podría permitir SSRF en aplicaciones que aceptan un argumento de nombre de host fsockopen o pfsockopen con la expectativa de que el número de puerto esté limitado. Debido a que se reconoce una sintaxis :port, fsockopen empleará el número de puerto especificado en el argumento del nombre de host en lugar del número de puerto en el segundo argumento de la función. • http://www.securityfocus.com/bid/97178 http://www.securitytracker.com/id/1038158 https://bugs.php.net/bug.php?id=74216 https://bugs.php.net/bug.php?id=75505 https://github.com/php/php-src/commit/bab0b99f376dac9170ac81382a5ed526938d595a https://security.netapp.com/advisory/ntap-20180112-0001 https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170403-0_PHP_Misbehavior_of_fsockopen_function_v10.txt • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.6EPSS: 0%CPEs: 13EXPL: 1CVE-2015-8866 – php: libxml_disable_entity_loader setting is shared between threads
https://notcve.org/view.php?id=CVE-2015-8866
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161. ext/libxml/libxml.c en PHP en versiones anteriores a 5.5.22 y 5.6.x en versiones anteriores a 5.6.6, cuando se utiliza PHP-FPM, no aisla cada hilo de cambios libxml_disable_entity_loader en otros hilos, lo que permite a atacantes remotos llevar a cabo ataques XML External Entity (XXE) y XML Entity Expansion (XEE) a través de un documento XML manipulado, un problema relacionado con la CVE-2015-5161. • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=de31324c221c1791b26350ba106cc26bad23ace9 http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html http://rhn.redhat.com/errata/RHSA-2016-2750.html http://www.openwall.com/lists/oss-security/2016/04/24/1 http://www.php.net/ChangeLog-5.php http://www.securityfocus.com/bid/ • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 1CVE-2016-1283 – pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)
https://notcve.org/view.php?id=CVE-2016-1283
The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(? • http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178193.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178955.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/79825 http://www.securitytracker.com/id/1034555 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.343110 https://access.redhat.com/errata/RHSA-2016:1132 https://bto.bluecoat.com/security-ad • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •