CVSS: 8.1EPSS: 2%CPEs: 102EXPL: 0CVE-2016-3171
https://notcve.org/view.php?id=CVE-2016-3171
12 Apr 2016 — Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation. Drupal 6.x en versiones anteriores a 6.38, cuando se utiliza con PHP en versiones anteriores a 5.4.45, 5.5.x en versiones anteriores a 5.5.29 o 5.6.x en versiones anteriores a 5.6.13, podría permitir a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el truncado de datos ... • http://www.debian.org/security/2016/dsa-3498 • CWE-19: Data Processing Errors •
CVSS: 9.8EPSS: 6%CPEs: 21EXPL: 1CVE-2016-3141 – php: Use after free in WDDX Deserialize when processing XML data
https://notcve.org/view.php?id=CVE-2016-3141
31 Mar 2016 — Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element. Vulnerabilidad de uso después de liberación de memoria en wddx.c en la extensión WDDX en PHP en versiones anteriores a 5.5.33 y 5.6.x en versiones anteriores a 5.6.19 permite a atacante... • https://github.com/peternguyen93/CVE-2016-3141 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-416: Use After Free •
CVSS: 8.2EPSS: 11%CPEs: 21EXPL: 0CVE-2016-3142 – php: Out-of-bounds read in phar_parse_zipfile()
https://notcve.org/view.php?id=CVE-2016-3142
31 Mar 2016 — The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location. La función phar_parse_zipfile en zip.c en la extensión PHAR en PHP en versiones anteriores a 5.5.33 y 5.6.x en versiones anteriores a 5.6.19 permite a atacantes remotos obtener información sensible ... • http://lists.apple.com/archives/security-announce/2016/May/msg00004.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 9.1EPSS: 8%CPEs: 28EXPL: 1CVE-2016-1903 – php: Out-of-bounds memory read via gdImageRotateInterpolated
https://notcve.org/view.php?id=CVE-2016-1903
19 Jan 2016 — The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function. La función gdImageRotateInterpolated en ext/gd/libgd/gd_interpolation.c en PHP en versiones anteriores a 5.5.31, 5.6.x en versiones anteriores a 5.6.17 y 7.x en versiones anteriores a 7.... • http://lists.opensuse.org/opensuse-updates/2016-01/msg00099.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 2%CPEs: 7EXPL: 1CVE-2016-1283 – pcre: heap buffer overflow in handling of duplicate named groups (8.39/14)
https://notcve.org/view.php?id=CVE-2016-1283
03 Jan 2016 — The pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\"){99}-))(? • http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178193.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 9.8EPSS: 5%CPEs: 5EXPL: 0CVE-2015-8383 – pcre: Buffer overflow caused by repeated conditional group (8.38/3)
https://notcve.org/view.php?id=CVE-2015-8383
02 Dec 2015 — PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. PCRE en versiones anteriores a 8.38 no maneja correctamente ciertos grupos condicionales repetidos, lo que permite a atacantes remotos causar una denegación de servicio (desbordamiento de buffer) o posiblemente tener otro ... • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 2%CPEs: 6EXPL: 0CVE-2015-8386 – pcre: Buffer overflow caused by lookbehind assertion (8.38/6)
https://notcve.org/view.php?id=CVE-2015-8386
02 Dec 2015 — PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. PCRE en versiones anteriores a 8.38 no maneja correctamente la interacción de aserciones lookbehind y de subpatrones mutuamente recursivos, lo que permite a atacantes remotos causar ... • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 0CVE-2015-8387 – Ubuntu Security Notice USN-2943-1
https://notcve.org/view.php?id=CVE-2015-8387
02 Dec 2015 — PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. PCRE en versiones anteriores a 8.38 no maneja correctamente las llamadas de subrutina (?123) y las llamadas de subrutina relacionadas, lo que permite a atacantes remotos causar una denegación de servicio ... • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 0CVE-2015-8389 – Ubuntu Security Notice USN-2943-1
https://notcve.org/view.php?id=CVE-2015-8389
02 Dec 2015 — PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. PCRE en versiones anteriores a 8.38 no maneja correctamente el patrón /(?:|a|){100}x/ y patrones relacionados, lo que permite a atacantes remotos causar una denegación de servicio (recursión infinita) o pos... • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-185: Incorrect Regular Expression •
CVSS: 9.8EPSS: 3%CPEs: 5EXPL: 0CVE-2015-8390 – Ubuntu Security Notice USN-2943-1
https://notcve.org/view.php?id=CVE-2015-8390
02 Dec 2015 — PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror. PCRE en versiones anteriores a 8.38 no maneja correctamente las subcadenas [: and \\ en clases carácter, lo que permite a atacantes remotos causar una denegación de servicio (lectura de memoria no inici... • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/174931.html • CWE-908: Use of Uninitialized Resource •