CVSS: 7.8EPSS: 0%CPEs: 67EXPL: 1CVE-2007-1883
https://notcve.org/view.php?id=CVE-2007-1883
06 Apr 2007 — PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows context-dependent attackers to read arbitrary memory locations via an interruption that triggers a user space error handler that changes a parameter to an arbitrary pointer, as demonstrated via the iptcembed function, which calls certain convert_to_* functions with its input parameters. PHP 4.0.0 hasta 4.4.6 y 5.0.0 hasta 5.2.1 permite a atacantes dependientes del contexto leer localizaciones de memoria de su elección a través de una interrupción que di... • http://secunia.com/advisories/24542 •
CVSS: 9.8EPSS: 1%CPEs: 66EXPL: 1CVE-2007-1885
https://notcve.org/view.php?id=CVE-2007-1885
06 Apr 2007 — Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a single character search string in conjunction with a long replacement string, which overflows a 32 bit length counter. NOTE: this is probably the same issue as CVE-2007-0906.6. Desbordamiento de búfer en la función en PHP 4 anterior a 4.4.5 y PHP 5 anterior a 5.2.1 permite a atacantes dependientes del contexto ejecutar código de su elección a través de ... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 •
CVSS: 9.8EPSS: 2%CPEs: 75EXPL: 1CVE-2007-1001 – PHP 5.2.1 'GD' Extension - '.WBMP' File Integer Overflow
https://notcve.org/view.php?id=CVE-2007-1001
06 Apr 2007 — Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or height values. Los múltiples desbordamientos de enteros en las funciones (1) createwbmp y (2) readwbmp en el archivo wbmp.c en la biblioteca GD (libgd) en PHP versión 4.0.0 hasta 4.4.6 y versión 5.0.0 hasta 5.2.1 permiten que los ataca... • https://www.exploit-db.com/exploits/29823 • CWE-189: Numeric Errors •
CVSS: 7.1EPSS: 0%CPEs: 74EXPL: 1CVE-2007-1835 – PHP 5.2.1 - 'Session.Save_Path()' TMPDIR open_basedir Restriction Bypass
https://notcve.org/view.php?id=CVE-2007-1835
03 Apr 2007 — PHP 4 before 4.4.5 and PHP 5 before 5.2.1, when using an empty session save path (session.save_path), uses the TMPDIR default after checking the restrictions, which allows local users to bypass open_basedir restrictions. PHP 4 anterior a 4.4.5 y PHP 5 anterior a 5.2.1, cuando se utiliza un parche de una sesión guardada vacia (session.save_path), utiliza por defecto TMPDIR despues de validar las restricciones, lo cual permite a usuarios locales evitar las restricciones open_basedir. • https://www.exploit-db.com/exploits/29801 •
CVSS: 7.5EPSS: 3%CPEs: 14EXPL: 1CVE-2007-1824
https://notcve.org/view.php?id=CVE-2007-1824
02 Apr 2007 — Buffer overflow in the php_stream_filter_create function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service (application crash) via a php://filter/ URL that has a name ending in the '.' character. Desbordamiento de búfer en la función php_stream_filter_create de PHP 5 anterior a 5.2.1 permite a atacantes remotos provocar una denegación de servicio (cierre de aplicación) mediante un URL php://filter/ que tiene un nombre terminado con el carácter '.'. • http://secunia.com/advisories/25056 •
CVSS: 9.1EPSS: 2%CPEs: 75EXPL: 3CVE-2007-1718 – PHP 5.2.1 - Folded Mail Headers Email Header Injection
https://notcve.org/view.php?id=CVE-2007-1718
28 Mar 2007 — CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To parameter, as demonstrated by a parameter containing a "\r\n\t\n" sequence, related to an increment bug in the SKIP_LONG_HEADER_SEP macro. Vulnerabilidad de inyección de retorno de carro y salto de línea (CRLF) en PHP 4.0.0 hasta 4.4.6... • https://www.exploit-db.com/exploits/29784 •
CVSS: 5.0EPSS: 0%CPEs: 75EXPL: 3CVE-2007-1717 – PHP 5.2.1 - Folded Mail Headers Email Header Injection
https://notcve.org/view.php?id=CVE-2007-1717
28 Mar 2007 — The mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 truncates e-mail messages at the first ASCIIZ ('\0') byte, which might allow context-dependent attackers to prevent intended information from being delivered in e-mail messages. NOTE: this issue might be security-relevant in cases when the trailing contents of e-mail messages are important, such as logging information or if the message is expected to be well-formed. La función mail en PHP 4.0.0 hasta 4.4.6 y 5.0.0 hasta 5.2.1 trunca los me... • https://www.exploit-db.com/exploits/29784 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2007-1710
https://notcve.org/view.php?id=CVE-2007-1710
27 Mar 2007 — The readfile function in PHP 4.4.4, 5.1.6, and 5.2.1 allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files by referring to local files with a certain URL syntax instead of a pathname syntax, as demonstrated by a filename preceded a "php://../../" sequence. La función readfile de PHP 4.4.4, 5.1.6, Y 5.2.1 permite a usuarios locales o remotos dependiendo del contexto evitar las restricciones del modo seguro (safe_mode) y leer archivos de su elección haciendo referencia a... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 •
CVSS: 9.8EPSS: 2%CPEs: 72EXPL: 2CVE-2007-1700 – PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow
https://notcve.org/view.php?id=CVE-2007-1700
27 Mar 2007 — The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted string in the session_register after unsetting HTTP_SESSION_VARS and _SESSION, which destroys the session data Hashtable. La extensión session de PHP 4 anterior a 4.4.5, y PHP 5 anterior a 5.2.1, calcula la cuenta de referencia para las v... • https://www.exploit-db.com/exploits/3571 •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 1CVE-2007-1701 – PHP < 4.4.5/5.2.1 - '_SESSION' Deserialization Overwrite
https://notcve.org/view.php?id=CVE-2007-1701
27 Mar 2007 — PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION|s:39:". PHP 4 anterior a 4.4.5, y PHP 5 anterior a 5.2.1, cuando register_globals está activado, permiten a atacantes locales o remotos dependiendo del contexto ejecutar código de su elección mediante una deseria... • https://www.exploit-db.com/exploits/3572 • CWE-502: Deserialization of Untrusted Data •