CVSS: 8.4EPSS: 45%CPEs: 2EXPL: 3CVE-2007-3997 – PHP 4.4.7/5.2.3 - MySQL/MySQLi 'Safe_Mode' Bypass
https://notcve.org/view.php?id=CVE-2007-3997
04 Sep 2007 — The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE. Las extensiones (1) MySQL y (2) MySQLi en PHP 4 anterior a 4.4.8, y PHP 5 anterior a 5.2.4, permite a atacantes remotos evitar las restricciones safe_mode y open_basedir a través de operaciones MySQL LOCAL INFILE, como se demostró con un consulta con LOAD DATA ... • https://www.exploit-db.com/exploits/4392 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 0CVE-2007-3996 – php multiple integer overflows in gd
https://notcve.org/view.php?id=CVE-2007-3996
04 Sep 2007 — Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function. Múltiples desbordamientos de búfer en libgd de PHP versiones anteriores a 5.2.4 permiten a atacantes remotos provocar una denegación de servicio (caí... • http://bugs.gentoo.org/show_bug.cgi?id=201546 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2007-4586 – PHP 5.2.0 (Windows x86) - 'PHP_iisfunc.dll' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-4586
29 Aug 2007 — Multiple buffer overflows in php_iisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iis_getservicestate function, related to the ServiceId argument to the (1) fnStartService, (2) fnGetServiceState, (3) fnStopService, and possibly other functions. Múltiples desbordamientos de búfer en php_iisfunc.dll de la extensión iisfunc para PHP 5.2.0 y... • https://www.exploit-db.com/exploits/4318 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3CVE-2007-4441 – PHP 5.2.3 - 'PHP_win32sti' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-4441
21 Aug 2007 — Buffer overflow in php_win32std.dll in the win32std extension for PHP 5.2.0 and earlier allows context-dependent attackers to execute arbitrary code via a long string in the filename argument to the win_browse_file function. Desbordamiento de búfer en php_win32std.dll en la extensión win32std para PHP 5.2.0 y anteriores permite a atacantes dependientes del contexto ejecutar código de su elección a través de una cadena larga en el argumento nombre de archivo (filename) en la función win_browse_file. • https://www.exploit-db.com/exploits/4303 •
CVSS: 9.8EPSS: 26%CPEs: 69EXPL: 1CVE-2007-3799 – PHP 5.2.3 - EXT/Session HTTP Response Header Injection
https://notcve.org/view.php?id=CVE-2007-3799
16 Jul 2007 — The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207. Una función session_start en ext/session en PHP versiones 4.x hasta 4.4.7 y versiones 5.x hasta 5.2.3... • https://www.exploit-db.com/exploits/30130 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 3CVE-2007-3378
https://notcve.org/view.php?id=CVE-2007-3378
29 Jun 2007 — The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess. Las funciones (1) session_save_path, (2) ini_set y (3) error_log en PHP versión 4.4.7 y versiones anteriores, y PHP versión 5 5.2.3 y versiones anteriores,... • http://docs.info.apple.com/article.html?artnum=307562 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 25%CPEs: 17EXPL: 1CVE-2007-2872 – PHP 5.1.6 - 'Chunk_Split()' Integer Overflow
https://notcve.org/view.php?id=CVE-2007-2872
04 Jun 2007 — Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments. Los múltiples desbordamientos de enteros en la función chunk_split en PHP versión 5 anterior a 5.2.3 y PHP versión 4 anterior a 4.4.8, permiten a los atacantes remotos causar una denegación de servicio (bloqueo) o ejecutar código arbitrario por medio de los argument... • https://www.exploit-db.com/exploits/30117 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 3%CPEs: 73EXPL: 0CVE-2007-2844
https://notcve.org/view.php?id=CVE-2007-2844
24 May 2007 — PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access. PHP 4.x y 5.x anterior al 5.2.1, cuando corre bajo sistemas multi-hilo, no asegura la seguridad de los hilos para las llamadas a la función libc crypt utilizando esquemas de protección como el mutex, lo que provoca una co... • http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 2CVE-2006-7205
https://notcve.org/view.php?id=CVE-2006-7205
24 May 2007 — The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value. La función array_fill en ext/standard/array.c de PHP 4.4.2 y 5.1.2 permite a atacantes remotos dependientes de contexto provocar una denegación de servicio (consumo de memoria) mediante una valor num largo. • http://securitytracker.com/id?1015979 •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2006-7204
https://notcve.org/view.php?id=CVE-2006-7204
22 May 2007 — The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents. La función imap_body en PHP anterior a 4.4.4 no implementa el modo seguro o las comprobaciones open_basedir, lo cual permite a usuarios locales leer archivos de su elección o listar el contenido de directorios de su elección. • http://bugs.php.net/bug.php?id=37265 •