CVSS: 9.1EPSS: 2%CPEs: 110EXPL: 5CVE-2011-1092 – PHP 5.3.6 - 'shmop_read()' Integer Overflow Denial of Service
https://notcve.org/view.php?id=CVE-2011-1092
15 Mar 2011 — Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function. Desbordamiento de entero en ext/shmop/shmop.c en PHP antes de v5.3.6, permite a usuarios locales o remotos provocar una denegación de servicio (caida) y posiblemente leer información sensible de la memoria a través de largos argumentos en la funcion shmop_read • https://www.exploit-db.com/exploits/16966 • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 0%CPEs: 108EXPL: 1CVE-2011-0755
https://notcve.org/view.php?id=CVE-2011-0755
02 Feb 2011 — Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax. Desbordamiento de entero en la función mt_rand en PHP anteriores a v5.3.4 podría facilitar a atacantes dependiendo del contexto predecir los valores que devuelve, aprovechando el uso de un script de un parámetro max grande, como lo demuestra un valor que exce... • http://bugs.php.net/46587 • CWE-189: Numeric Errors •
CVSS: 9.1EPSS: 0%CPEs: 99EXPL: 0CVE-2011-0752
https://notcve.org/view.php?id=CVE-2011-0752
02 Feb 2011 — The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758. La función Extract en PHP anteriores a v5.2.15 no previenen la utilización del parámetro EXTR_OVERWRITE para sobreescribir (1) la ... • http://marc.info/?l=bugtraq&m=133469208622507&w=2 • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 70EXPL: 0CVE-2011-0754
https://notcve.org/view.php?id=CVE-2011-0754
02 Feb 2011 — The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check. La función SplFileInfo::getType PHP Library (SPL) en la extensión en PHP anterior a v5.3.4 en Windows no detecta correctamente los enlaces simbólicos, lo que podría facili... • http://bugs.php.net/51763 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 8.1EPSS: 0%CPEs: 69EXPL: 0CVE-2011-0753
https://notcve.org/view.php?id=CVE-2011-0753
02 Feb 2011 — Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals. Condición de carrera en la extensión PCNTL en PHP anteriores a 5.3.4, cuando existe un gestor de señal definido por el usuario, podría permitir a atacantes dependiendo del contexto provocar una denegación de servicio (corrupción de memoria) a través de un número de señales muy g... • http://bugs.php.net/52784 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 1%CPEs: 14EXPL: 0CVE-2010-4698
https://notcve.org/view.php?id=CVE-2010-4698
18 Jan 2011 — Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function. Desbordamiento de búfer basado en pila en la extensión GD en PHP en versiones anteriores a 5.2.15 y 5.3.x en versiones anteriores a 5.3.4 permite a atacantes dependientes del contexto provocar una denegación de servicio (caída de la aplicación) a tra... • http://bugs.php.net/53492 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 108EXPL: 0CVE-2010-4699
https://notcve.org/view.php?id=CVE-2010-4699
18 Jan 2011 — The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ks_c_5601-1987 character set. La función iconv_mime_decode_headers en la extensión Iconv para P... • http://bugs.php.net/52941 • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 0%CPEs: 103EXPL: 0CVE-2010-4697
https://notcve.org/view.php?id=CVE-2010-4697
18 Jan 2011 — Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and __unset methods on objects accessed by a reference. Vulnerabilidad uso después de liberación en el motor de Zend en PHP anterior a v5.2.15 y v5.3.x antes de v5.3.4 podría permitir a atacantes dependientes de contexto provocar una denega... • http://bugs.php.net/52879 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 108EXPL: 1CVE-2006-7243 – php: paths with NULL character were considered valid
https://notcve.org/view.php?id=CVE-2006-7243
18 Jan 2011 — PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function. PHP anterior a v5.3.4 acepta el caracter \0 en un nombre de ruta, lo que podría permitir a atacantes dependientes de contexto eludir las restricciones de acceso colocando una extensión de archivo después de este caracter, como se... • http://bugs.php.net/39863 • CWE-20: Improper Input Validation CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 7.5EPSS: 1%CPEs: 22EXPL: 4CVE-2010-4645 – PHP 5.3.2 - 'zend_strtod()' Floating-Point Value Denial of Service
https://notcve.org/view.php?id=CVE-2010-4645
11 Jan 2011 — strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308. strtod.c, tal como se utiliza en la función zend_strtod en PHP v5.2 anterior de v5.2.17 y v5.3 anterior de v5.3.5, y otros productos, permite a atacantes dependi... • https://www.exploit-db.com/exploits/35164 • CWE-189: Numeric Errors •