CVSS: 7.5EPSS: 6%CPEs: 2EXPL: 2CVE-2011-3379
https://notcve.org/view.php?id=CVE-2011-3379
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders. La función de PHP v5.3.7 y v5.3.8 activa una llamada a la función __autoload, lo que hace más fácil para los atacantes remotos ejecutar código arbitrario mediante una URL y el aprovechamiento de los comportamientos potencialmente peligrosos en ciertos paquetes de PEAR y cargadores automáticos de medida. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 http://securityreason.com/securityalert/8525 http://svn.php.net/viewvc/?view=revision&revision=317183 http://www.byte.nl/blog/2011/09/23/security-bug-in-is_a-function-in-php-5-3-7-5-3-8 http://www.securityfocus.com/archive/1/519770/30/0/threaded https://bugs.php.net/bug.php?id=55475 https://bugzilla.redhat.com/show_bug.cgi?id=741020 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 1%CPEs: 28EXPL: 0CVE-2011-4078
https://notcve.org/view.php?id=CVE-2011-4078
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379. inclinclude/iniset.php en Roundcube Webmail v0.5.4 y anteriores, cuando PHP v5.3.7 o v5.3.8 se utiliza, permite a atacantes remotos provocar una solicitud GET para una dirección arbitraria, y provocar una denegación de servicio (consumo de recursos y la interrupción de la bandeja de entrada), a través de un encabezado de asunto que sólo contiene una URL, un asunto relacionado con CVE-2011-3379. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 http://openwall.com/lists/oss-security/2011/10/26/6 http://trac.roundcube.net/ticket/1488086 http://www.securityfocus.com/bid/50402 https://exchange.xforce.ibmcloud.com/vulnerabilities/71025 • CWE-399: Resource Management Errors •
CVSS: 10.0EPSS: 1%CPEs: 105EXPL: 0CVE-2011-3268
https://notcve.org/view.php?id=CVE-2011-3268
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483. Desbordamiento de búfer en la función de cifrado en PHP antes de v5.3.7, permite a atacantes dependientes de contexto tener un impacto no especificado a través de un argumento "long salt", una vulnerabilidad diferente a CVE-2011-2483. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://osvdb.org/74738 http://support.apple.com/kb/HT5130 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/ext/standard/php_crypt_r.c?r1=311300&r2=311390&pathrev=315218 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165 http://www.php.net/ChangeLog-5.php#5.3.7 http://www.php.net/archive/2011.php#id2011-08-18-1 http://www.securityfocus.com/bid/49241 https://exch • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 1%CPEs: 105EXPL: 0CVE-2011-3267
https://notcve.org/view.php?id=CVE-2011-3267
PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors. PHP antes de v5.3.7 no aplica correctamente la función error_log, lo que permite a atacantes dependientes del contexto provocar una denegación de servicio (caída de aplicación) a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://osvdb.org/74739 http://support.apple.com/kb/HT5130 http://www.mandriva.com/security/advisories?name=MDVSA-2011:165 http://www.php.net/ChangeLog-5.php#5.3.7 http://www.php.net/archive/2011.php#id2011-08-18-1 http://www.securityfocus.com/bid/49241 https://exchange.xforce.ibmcloud.com/vulnerabilities/69428 • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 1CVE-2011-3189
https://notcve.org/view.php?id=CVE-2011-3189
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483. La función de cifrado en PHP v5.3.7, cuando el tipo de hash MD5 se utiliza, se devuelve el valor del argumento en vez de la cadena hash, lo que podría permitir a atacantes remotos evitar la autenticación a través de una contraseña arbitraria, una vulnerabilidad diferente a CVE-2011-2483. • http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://osvdb.org/74726 http://secunia.com/advisories/45678 http://support.apple.com/kb/HT5130 http://www.openwall.com/lists/oss-security/2011/08/23/4 http://www.php.net/ChangeLog-5.php#5.3.8 http://www.php.net/archive/2011.php#id2011-08-23-1 https://bugs.gentoo.org/show_bug.cgi?id=380261 https://bugs.php.net/bug.php?id=55439 https://exchange.xforce.ibmcloud.com/vulnerabilities/ • CWE-310: Cryptographic Issues •