CVSS: 6.8EPSS: 22%CPEs: 70EXPL: 1CVE-2014-3670 – php: heap corruption issue in exif_thumbnail()
https://notcve.org/view.php?id=CVE-2014-3670
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function. La función exif_ifd_make_value en exif.c en la extensión EXIF en PHP anterior a 5.4.34, 5.5.x anterior a 5.5.18, y 5.6.x anterior a 5.6.2 opera sobre arrays de punto flotante incorrectamente, lo que permite a atacantes remotos causar una denegación de servicio (corrupción de memoria dinámica y caída de aplicación) o posiblemente ejecutar código arbitrario a través de un imagen JPEG manipulado con datos 'thumbnail' TIFF que son manejados indebidamente por la función exif_thumbnail. A buffer overflow flaw was found in the Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_thumbnail() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=ddb207e7fa2e9adeba021a1303c3781efda5409b http://linux.oracle.com/errata/ELSA-2014-1767.html http://linux.oracle.com/errata/ELSA-2014-1768.html http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00024.html http://lists.opensuse.org/opensuse-updates/2014-11/msg00034.html http://lists.opensuse.org/opensuse-updates/2015-01/msg00006.html http://php.net/ChangeLog-5.php&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.6EPSS: 0%CPEs: 5EXPL: 1CVE-2014-5459
https://notcve.org/view.php?id=CVE-2014-5459
The PEAR_REST class in REST.php in PEAR in PHP through 5.6.0 allows local users to write to arbitrary files via a symlink attack on a (1) rest.cachefile or (2) rest.cacheid file in /tmp/pear/cache/, related to the retrieveCacheFirst and useLocalCache functions. La clase PEAR_REST en REST.php en PEAR en PHP hasta 5.6.0 permite a usuarios locales escribir en ficheros arbitrarios a través de un ataque de enlace simbólico sobre un fichero (1) rest.cachefile o (2) rest.cacheid en /tmp/pear/cache/, relacionado con las funciones retrieveCacheFirst y useLocalCache. • http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html http://www.openwall.com/lists/oss-security/2014/08/27/3 http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759282 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 6.4EPSS: 0%CPEs: 68EXPL: 0CVE-2014-5120 – php: gd extension NUL byte injection in file names
https://notcve.org/view.php?id=CVE-2014-5120
gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function. gd_ctx.c en el componente GD en PHP 5.4.x anterior a 5.4.32 y 5.5.x anterior a 5.5.16 no asegura que a los nombres de rutas les falten las secuencias %00, lo que podría permitir a atacantes remotos sobrescribir ficheros arbitrarios a través de entradas manipuladas en una aplicación que llama la función (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp o (7) imagewebp. It was found that PHP's gd extension did not properly handle file names with a null character. A remote attacker could possibly use this flaw to make a PHP application access unexpected files and bypass intended file system access restrictions. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html http://php.net/ChangeLog-5.php http://rhn.redhat.com/errata/RHSA-2014-1327.html http://rhn.redhat.com/errata/RHSA-2014-1765.html http://rhn.redhat.com/errata/RHSA-2014-1766.html http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html https://bugs.php.net/bug.php?id=67730 https://support.apple.com/HT204659 https:&#x • CWE-20: Improper Input Validation CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 6.8EPSS: 2%CPEs: 68EXPL: 0CVE-2014-3597 – php: multiple buffer over-reads in php_parserr
https://notcve.org/view.php?id=CVE-2014-3597
Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049. Múltiples desbordamientos de buffer en la función php_parserr en ext/standard/dns.c en PHP anterior a 5.4.32 y 5.5.x anterior a 5.5.16 permiten a servidores DNS remotos causar una denegación de servicio (la caída de la aplicación) o posiblemente ejecutar código arbitrario a través de un registro DNS manipulado, relacionado con la función dns_get_record y la función dn_expand. NOTA: este problema existe debido a una solución incompleta para CVE-2014-4049. Multiple buffer over-read flaws were found in the php_parserr() function of PHP. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00024.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00055.html http://php.net/ChangeLog-5.php http://rhn.redhat.com/errata/RHSA-2014-1326.html http://rhn.redhat.com/errata/RHSA-2014-1327.html http://rhn.redhat.com/errata/RHSA-2014-1765.html http://rhn.redhat.com/errata/RHSA-2014-1766.html http://secunia.com/advisories/60609 http:& • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 4.3EPSS: 8%CPEs: 88EXPL: 2CVE-2014-3587 – file: incomplete fix for CVE-2012-1571 in cdf_read_property_info
https://notcve.org/view.php?id=CVE-2014-3587
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571. Desbordamiento de enteros en la función cdf_read_property_info en cdf.c en ficheros hasta 5.19, utilizado en el componente Fileinfo en PHP anterior a 5.4.32 y 5.5.x anterior a 5.5.16, permite a atacantes remotos causar una denegación de servicios (la caída de la aplicación) a través de un fichero CDF manipulado. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2012-1571. It was found that the fix for CVE-2012-1571 was incomplete; the File Information (fileinfo) extension did not correctly parse certain Composite Document Format (CDF) files. • http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html http://php.net/ChangeLog-5.php http://rhn.redhat.com/errata/RHSA-2014-1326.html http://rhn.redhat.com/errata/RHSA-2014-1327.html http://rhn.redhat.com/errata/RHSA-2014-1765.html http://rhn.redhat.com/errata/RHSA-2014-1766.html http://rhn.redhat.com/errata/RHSA-2016-0760.html http://secunia.com/advisories/60609 http://secunia.com/advisories/60696 http://www.debian.org/security/2014/dsa- • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •