CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 1CVE-2006-4484 – gd: GIF handling buffer overflow
https://notcve.org/view.php?id=CVE-2006-4484
31 Aug 2006 — Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. Desbordamiento de búfer en la función LWZReadByte_ en ext/gd/libgd/gd_gif_in.c en la extensión GD en PHP anterior a 5.1.5 permite a atacantes remotos tener un impacto desconocido mediante un fichero GIF con input_code_size m... • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc •
CVSS: 10.0EPSS: 2%CPEs: 4EXPL: 0CVE-2006-4485
https://notcve.org/view.php?id=CVE-2006-4485
31 Aug 2006 — The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read. La función stripos en PHP anterior a 5.1.5 tiene impacto desconocido y vectores de ataque relacionados con una lectura fuera de rango. • http://rhn.redhat.com/errata/RHSA-2006-0688.html •
CVSS: 9.1EPSS: 1%CPEs: 5EXPL: 0CVE-2006-4486
https://notcve.org/view.php?id=CVE-2006-4486
31 Aug 2006 — Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction. Desbordamiento de enteros en rutinas de asignación de memoria en PHP anterior a 5.1.6, cuando se ejecuta en sistemas de 64 bits, permite a atacantes dependientes de contexto evitar la restricción memory_limit. • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 2%CPEs: 65EXPL: 0CVE-2006-4433
https://notcve.org/view.php?id=CVE-2006-4433
29 Aug 2006 — PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation. PHP anterior a 4.... • http://secunia.com/advisories/21573 •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 2CVE-2006-4023
https://notcve.org/view.php?id=CVE-2006-4023
09 Aug 2006 — The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class o... • http://retrogod.altervista.org/php_ip2long.htm •
CVSS: 9.8EPSS: 3%CPEs: 67EXPL: 4CVE-2006-4020 – PHP 4.4.3/5.1.4 - 'sscanf' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-4020
08 Aug 2006 — scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. scanf.c en PHP 5.1.4 y anteriores, y 4.4.3 y anteriores, permite a atacantes (locales o remotos dependiendo del contexto) ejecutar código de su elección mediante una llamada a la función sscanf de PHP que realiza un intercambio de argumentos que ... • https://www.exploit-db.com/exploits/2193 •
CVSS: 7.8EPSS: 0%CPEs: 77EXPL: 2CVE-2006-3011 – PHP 5.2.6 - 'error_log' Safe_mode Bypass
https://notcve.org/view.php?id=CVE-2006-3011
26 Jun 2006 — The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode. La función error_log en basic_functions.c en PHP anterior v4.4.4 y v5.x anterior v5.1.5 permite a usuarios locales superar el modo de seguridad y las restricciones open_basedir a través de un "php://" u otros esquemas en el tercer argumento, que deshabilitan el modo seguro. • https://www.exploit-db.com/exploits/7171 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 6%CPEs: 1EXPL: 1CVE-2006-3016
https://notcve.org/view.php?id=CVE-2006-3016
14 Jun 2006 — Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implie... • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc •
CVSS: 9.3EPSS: 4%CPEs: 85EXPL: 0CVE-2006-3017
https://notcve.org/view.php?id=CVE-2006-3017
14 Jun 2006 — zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. • ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2006-3018
https://notcve.org/view.php?id=CVE-2006-3018
14 Jun 2006 — Unspecified vulnerability in the session extension functionality in PHP before 5.1.3 has unknown impact and attack vectors related to heap corruption. Vulnerabilidad no especificada en la funcionalidad de extensión de sesión en PHP anterior a la versión 5.1.3 tiene un impacto y vectores de ataque desconocidos, relacionados con una corrupción de memoria dinámica. • http://secunia.com/advisories/19927 •