CVSS: 6.5EPSS: 12%CPEs: 29EXPL: 0CVE-2017-7890 – php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function
https://notcve.org/view.php?id=CVE-2017-7890
02 Aug 2017 — The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image could use the uninitialized tables to read ~700 bytes from the top of the stack, potentially disclosing sensitive information. La función de descodificación de GIF "gdImageCreateFromGifCtx " en gd_gif_in.c en GD Graphics Library (también conocido como libgd),que se usa en PHP en vers... • http://php.net/ChangeLog-5.php • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 29EXPL: 0CVE-2017-11628 – php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c
https://notcve.org/view.php?id=CVE-2017-11628
25 Jul 2017 — In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE: this is only relevant for PHP applications that accept untrusted input (instead of the system's php.ini file) for the parse_ini_string or parse_ini_file function, e.g., a web application for syntax validation of php.ini directives. En PHP, en versiones anteriores a la 5.6.31, versio... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=05255749139b3686c8a6a58ee01131ac0047465e • CWE-20: Improper Input Validation CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 0%CPEs: 29EXPL: 0CVE-2017-11145 – php: wddx_deserialize() heap out-of-bound read via php_parse_date()
https://notcve.org/view.php?id=CVE-2017-11145
10 Jul 2017 — In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parse_date.c out-of-bounds reads affecting the php_parse_date function. NOTE: the correct fix is in the e8b7698f5ee757ce2c8bd10a192a491a498f891c commit, not the bd77ac90d3bdf31ce2a5251ad92e9e75 gist. En PHP anterior a versión 5.6.31, versión 7.x anterior a 7.0.21... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e8b7698f5ee757ce2c8bd10a192a491a498f891c • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 29EXPL: 0CVE-2017-11144 – php: Incorrect return value check of OpenSSL sealing function leads to crash
https://notcve.org/view.php?id=CVE-2017-11144
10 Jul 2017 — In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission. En PHP, en versiones anteriores a la 5.6.31, las versiones 7.x anteriores a la 7.0.21 y las versiones 7.1.x anteriores a la 7.1.7, el código de sellado PEM de la exten... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e • CWE-253: Incorrect Check of Function Return Value CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.8EPSS: 6%CPEs: 21EXPL: 0CVE-2017-11142 – Debian Security Advisory 4081-1
https://notcve.org/view.php?id=CVE-2017-11142
10 Jul 2017 — In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c. En PHP anterior a versión 5.6.31, versión 7.x anterior a 7.0.17 y versión 7.1.x anterior a 7.1.3, los atacantes remotos podrían causar un ataque de denegación de servicio de consumo de CPU mediante la inyección de variables de formulario largo, relacionadas con el archivo main/php_variables.c. Several vulne... • http://openwall.com/lists/oss-security/2017/07/10/6 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 1CVE-2017-11147 – php: Out-of-bounds read in phar_parse_pharfile
https://notcve.org/view.php?id=CVE-2017-11147
10 Jul 2017 — In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c. En PHP anterior a versión 5.6.30 y versión 7.x anterior a 7.0.15, el manejador de archivos PHAR podría ser utilizado por archivos maliciosos suministrados por los atacantes para bloquear el intérprete PHP o potencialmente divulgar info... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=e5246580a85f031e1a3b8064edbaa55c1643a451 • CWE-20: Improper Input Validation CWE-125: Out-of-bounds Read •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2016-10397 – Ubuntu Security Notice USN-3382-2
https://notcve.org/view.php?id=CVE-2016-10397
10 Jul 2017 — In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated by evil.example.com:80#@good.example.com/ and evil.example.com:80?@good.example.com/ inputs to the parse_url function (implemented in the php_url_parse_ex function in ext/standard/url.c). En PHP, en versiones anteriores a la 5.6.28 y en versiones 7.x anteriores a la 7.0.13, la manipulación incorrecta de varios componente... • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=b061fa909de77085d3822a89ab901b934d0362c4 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2017-11143 – php: Incorrect WDDX deserialization of boolean parameters leads to DoS
https://notcve.org/view.php?id=CVE-2017-11143
10 Jul 2017 — In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c. En PHP anterior a versión 5.6.31, una liberación no válida en la deserialización WDDX de parámetros booleanos podría ser utilizada por atacantes capaces de inyectar XML para la deserialización en el bloqueo del intérprete PHP, relacionado con una liber... • http://openwall.com/lists/oss-security/2017/07/10/6 • CWE-416: Use After Free CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2017-9226 – oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation
https://notcve.org/view.php?id=CVE-2017-9226
24 May 2017 — An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bou... • http://www.securityfocus.com/bid/101244 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2017-9229 – oniguruma: Invalid pointer dereference in left_adjust_char_head()
https://notcve.org/view.php?id=CVE-2017-9229
24 May 2017 — An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A SIGSEGV occurs in left_adjust_char_head() during regular expression compilation. Invalid handling of reg->dmax in forward_search_range() could result in an invalid pointer dereference, normally as an immediate denial-of-service condition. Se descubrió un problema en Oniguruma versión 6.2.0, como es usado en Oniguruma-mod en Ruby hasta versión 2.4.1 y mbstring en PHP hasta versión 7... • https://access.redhat.com/errata/RHSA-2018:1296 • CWE-476: NULL Pointer Dereference CWE-787: Out-of-bounds Write •