CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 1CVE-2020-7059 – OOB read in php_strip_tags_ex
https://notcve.org/view.php?id=CVE-2020-7059
10 Feb 2020 — When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash. Cuando se usa la función fgetss() para leer datos con etiquetas de eliminación, en PHP versiones 7.2.x por debajo de 7.2.27, versiones 7.3.x por debajo de 7.3.14 y versiones 7.4.x por debajo de 7.4.2, es posible suministrar dat... • http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00023.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 1CVE-2019-11050 – Use-after-free in exif parsing under memory sanitizer
https://notcve.org/view.php?id=CVE-2019-11050
23 Dec 2019 — When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Cuando la extensión PHP EXIF se encuentra analizando información EXIF de una imagen, por ejemplo por medio de la función exif_read_data(), en PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x po... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2019-11049 – mail() may release string with refcount==1 twice
https://notcve.org/view.php?id=CVE-2019-11049
23 Dec 2019 — In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations. En PHP versiones 7.3.x por debajo de 7.3.13 y 7.4.0 en Windows, al suministrar encabezados personalizados para la función mail(), debido a un error introducido en el commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, si el encabe... • https://bugs.php.net/bug.php?id=78943 • CWE-415: Double Free •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 1CVE-2019-11047 – Heap-buffer-overflow READ in exif
https://notcve.org/view.php?id=CVE-2019-11047
23 Dec 2019 — When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 it is possible to supply it with data what will cause it to read past the allocated buffer. This may lead to information disclosure or crash. Cuando la extensión EXIF de PHP está analizando información EXIF de una imagen, por ejemplo por medio de la función exif_read_data(), PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-125: Out-of-bounds Read •
CVSS: 5.3EPSS: 0%CPEs: 16EXPL: 0CVE-2019-11046 – Buffer underflow in bc_shift_addsub
https://notcve.org/view.php?id=CVE-2019-11046
23 Dec 2019 — In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying it with string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can read to disclosure of the content of some memory locations. En PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo de 7.3.13 y 7.4.0, las funciones de extensión bcmath de PHP en alg... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-125: Out-of-bounds Read •
CVSS: 5.9EPSS: 0%CPEs: 16EXPL: 1CVE-2019-11045 – DirectoryIterator class silently truncates after a null byte
https://notcve.org/view.php?id=CVE-2019-11045
23 Dec 2019 — In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access. En PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo de 7.3.13 y 7.4.0, la clase DirectoryIterator de PHP acepta nombres de archivo con \0 byte insertado y los trata como terminando en ese byte. Es... • http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00036.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-170: Improper Null Termination •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2019-11044 – link() silently truncates after a null byte on Windows
https://notcve.org/view.php?id=CVE-2019-11044
23 Dec 2019 — In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, PHP link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g. in applications checking paths that the code is allowed to access. En PHP versiones 7.2.x por debajo de 7.2.26, versiones 7.3.x por debajo de 7.3.13 y 7.4.0 en Windows, la función PHP link() acepta nombres de archivo con /0 byte insertado y los trata como terminando en ese byte. ... • https://bugs.php.net/bug.php?id=78862 • CWE-170: Improper Null Termination •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2017-9118 – php: Out of bounds access in php_pcre.c:php_pcre_replace_impl()
https://notcve.org/view.php?id=CVE-2017-9118
02 Aug 2018 — PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. PHP 7.1.5 tiene un acceso fuera de límites en php_pcre_replace_impl mediante una llamada preg_replace. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Issues addressed include buffer overflow, bypass, cross site scripting, denial of service, information leakage, and null pointer vulnerabilities. • https://access.redhat.com/errata/RHSA-2019:2519 • CWE-125: Out-of-bounds Read CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 1CVE-2017-9120 – php: Integer overflow in mysqli_api.c:mysqli_real_escape_string()
https://notcve.org/view.php?id=CVE-2017-9120
02 Aug 2018 — PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string. PHP en versiones 7.x hasta la 7.1.5, permite que atacantes remotos provoquen una denegación de servicio (desbordamiento de búfer y cierre inesperado de la aplicación) o, probablemente, cualquier otro tipo de problema mediante una cadena larga debido a un desbordamiento de ent... • https://access.redhat.com/errata/RHSA-2019:2519 • CWE-190: Integer Overflow or Wraparound •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-8923 – Ubuntu Security Notice USN-5300-3
https://notcve.org/view.php?id=CVE-2017-8923
12 May 2017 — The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. La función zend_string_extend en el archivo Zend/zend_string.h en PHP hasta de la versión 7.1.5 no impide cambios en los objetos de cadena que resultan en una longitud negativa, lo que... • http://www.securityfocus.com/bid/98518 • CWE-787: Out-of-bounds Write •