CVSS: 5.0EPSS: 1%CPEs: 105EXPL: 0CVE-2011-3267
https://notcve.org/view.php?id=CVE-2011-3267
PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors. PHP antes de v5.3.7 no aplica correctamente la función error_log, lo que permite a atacantes dependientes del contexto provocar una denegación de servicio (caída de aplicación) a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://osvdb.org/74739 http://support.apple.com/kb/HT5130 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165 http://www.php.net/ChangeLog-5.php#5.3.7 http://www.php.net/archive/2011.php#id2011-08-18-1 http://www.securityfocus.com/bid/49241 https://exchange.xforce.ibmcloud.com/vulnerabilities/69428 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 1%CPEs: 105EXPL: 5CVE-2011-3182 – PHP < 5.3.7 - Multiple Null Pointer Dereference Denial of Service Vulnerabilities
https://notcve.org/view.php?id=CVE-2011-3182
PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function. PHP anterior a 5.3.7 no comprueba correctamente valores de retorno en las funciones malloc, calloc, y realloc, lo que permite a atacantes dependientes del contexto provocar una denegación de servicio (desreferenciar un puntero NULL y caída de la aplicación) o provocar un desbordamiento de búfer elevando la abilidad de proporcionar un valor de su elección para un argumento de una función, relacionado con (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, y (11) la función strtotime. • https://www.exploit-db.com/exploits/36070 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://marc.info/?l=full-disclosure&m=131373057621672&w=2 http://securityreason.com/achievement_securityalert/101 http://support.apple.com/kb/HT5130 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165 http://www.openwall.com/lists/oss-security/2011/08/22/9 http://www.securityfocus.com/bid/49249 https://exchange.xforce.ibmcloud.com/vulnerabilities/69430 •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2011-2483 – crypt_blowfish: 8-bit character mishandling allows different password pairs to produce the same hash
https://notcve.org/view.php?id=CVE-2011-2483
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash. crypt_blowfish en versiones anteriores a 1.1, como se utiliza en PHP en versiones anteriores a 5.3.7 en ciertas plataformas, PostgreSQL en versiones anteriores a 8.4.9 y otros productos, no maneja adecuadamente caracteres de 8-bit, lo que hace más fácil a atacantes dependientes de contexto determinar una contraseña en texto plano aprovechando el conocimiento del hash de una contraseña. • http://freshmeat.net/projects/crypt_blowfish http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00015.html http://php.net/security/crypt_blowfish http://support.apple.com/kb/HT5130 http://www.debian.org/security/2011/dsa-2340 http://www.debian.org/security/2012/dsa-2399 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165&# • CWE-310: Cryptographic Issues •
CVSS: 6.4EPSS: 5%CPEs: 72EXPL: 2CVE-2011-2202 – PHP 5.3.6 - Security Bypass
https://notcve.org/view.php?id=CVE-2011-2202
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability." La función rfc1867_post_handler en main/rfc1867.c en PHP anterior a v5.3.7 no restringe correctamente los nombres de archivo en solicitudes POST multipart/form-data, lo que permite a atacantes remotos llevar a cabo ataques de salto de directorio, y, posiblemente, crear o sobreescribir archivos arbitrarios, a través de una elaborada petición de carga, en relación con una "vulnerabilidad de inyección de la ruta del archivo" (file path injection vulnerability) • https://www.exploit-db.com/exploits/35855 http://bugs.php.net/bug.php?id=54939 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://openwall.com/lists/oss-security/2011/06/12/5 http://openwall.com/lists/oss-security/2011/06/13/15 http://pastebin.com/1edSuSVN http://rhn.redhat.com/errata/RHSA-2012-0071.html http://secunia.com/advisories/44874 http://securitytracker.com/id?1025659 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 15%CPEs: 110EXPL: 4CVE-2011-1468 – PHP < 5.3.6 'OpenSSL' Extension - 'openssl_decrypt' Ciphertext Data Memory Leak Denial of Service
https://notcve.org/view.php?id=CVE-2011-1468
Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function. Múltiples fugas de memoria en la extensión OpenSSL de PHP anteriores a v5.3.6 podría permitir a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de (1) datos en texto plano sobre la función openssl_encrypt o (2) Los datos de texto cifrado a la función openssl_decrypt. • https://www.exploit-db.com/exploits/35487 https://www.exploit-db.com/exploits/35486 http://bugs.php.net/bug.php?id=54060 http://bugs.php.net/bug.php?id=54061 http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://support.apple.com/kb/HT5002 http://www.mandriva.com/security/advisories?name=MDVSA-2011:053 http://www.php.net/ChangeLog-5.php http://www.redhat.com/support/errata/RHSA-2011-1423.html http://www.securityfocus.com/bid/46 • CWE-399: Resource Management Errors CWE-401: Missing Release of Memory after Effective Lifetime •