CVSS: 7.5EPSS: 3%CPEs: 17EXPL: 0CVE-2016-10161 – php: Out-of-bounds heap read on unserialize in finish_nested_data()
https://notcve.org/view.php?id=CVE-2016-10161
The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. La función object_common1 en ext/standard/var_unserializer.c en PHP en versiones anteriores a 5.6.30, 7.0.x en versiones anteriores a 7.0.15 y 7.1.x en versiones anteriores a 7.1.1 permite a atacantes remotos provocar una denegación de servicio (sobre lectura de búfer y caída de aplicación) a través de datos serializados manipulados que se maneja mal en una llamada finish_nested_data. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.debian.org/security/2017/dsa-3783 http://www.securityfocus.com/bid/95768 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73825 https://github.com/php/php-src/commit/16b3003ffc6393e250f069aa28a78dc5a2c064b2 https://security.gentoo.org/glsa/201702-29 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.tenable.co • CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 1%CPEs: 16EXPL: 0CVE-2016-10162 – php: Null pointer dereference when unserializing PHP object
https://notcve.org/view.php?id=CVE-2016-10162
The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call. La función php_wddx_pop_element en ext/wddx/wddx.c en PHP 7.0.x en versiones anteriores a 7.0.15 y 7.1.x en versiones anteriores a 7.1.1 permite a atacantes remotos provocar una denegación de servicio (referencia a puntero NULL y caída de aplicación) a través de un nombre de clase inaplicable en un documento XML wddxPacket, esto lleva a un mal manejo en una llamada la wddx_deserialize. • http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/95668 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73831 https://github.com/php/php-src/commit/8d2539fa0faf3f63e1d1e7635347c5b9e777d47b https://access.redhat.com/security/cve/CVE-2016-10162 https://bugzilla.redhat.com/show_bug.cgi?id=1419012 • CWE-476: NULL Pointer Dereference •
CVSS: 9.8EPSS: 1%CPEs: 15EXPL: 1CVE-2016-7479 – php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object
https://notcve.org/view.php?id=CVE-2016-7479
In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution. En todas las versiones de PHP 7, durante el proceso no serializado, redimensionando las "propiedades" de la tabla hash de un objeto serializado puede conducir a un uso después de liberación de memoria. Un atacante remoto puede explotar este error para obtener ejecución de código arbitraria. • http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7 http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf http://www.securityfocus.com/bid/95151 http://www.securitytracker.com/id/1037659 https://access.redhat.com/errata/RHSA-2018:1296 https://bugs.php.net/bug.php?id=73092 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.youtube.com/watch?v=LDcaPstAuPk https://access. • CWE-416: Use After Free •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2016-7480
https://notcve.org/view.php?id=CVE-2016-7480
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data. La implementación no serializable SplObjectStorage en ext/spl/spl_observer.c en PHP en versiones anteriores a 7.0.12 no verifica que una clave sea un objeto, lo que permite a atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (acceso a memoria no inicializada) a través de datos serializados manipulados. • http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7 http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/95152 https://bugs.php.net/bug.php?id=73257 https://github.com/php/php-src/commit/61cdd1255d5b9c8453be71aacbbf682796ac77d4 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.youtube.com/watch?v=LDcaPstAuPk • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 9%CPEs: 202EXPL: 1CVE-2016-7478
https://notcve.org/view.php?id=CVE-2016-7478
Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876. cccZend/zend_exceptions.c en PHP, posiblemente en 5.x en versiones anteriores a 5.6.28 y 7.x en versiones anteriores a 7.0.13, permite a atacantes remotos provocar una denegación de servicio (bucle infinito) a través de un objeto Exception manipulado en datos serializados, un caso relacionado con CVE-2015-8876. • http://blog.checkpoint.com/2016/12/27/check-point-discovers-three-zero-day-vulnerabilities-web-programming-language-php-7 http://blog.checkpoint.com/wp-content/uploads/2016/12/PHP_Technical_Report.pdf http://www.securityfocus.com/bid/95150 https://bugs.php.net/bug.php?id=73093 https://security.netapp.com/advisory/ntap-20180112-0001 https://www.youtube.com/watch?v=LDcaPstAuPk •