CVSS: 5.0EPSS: 1%CPEs: 14EXPL: 0CVE-2010-4698
https://notcve.org/view.php?id=CVE-2010-4698
Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function. Desbordamiento de búfer basado en pila en la extensión GD en PHP en versiones anteriores a 5.2.15 y 5.3.x en versiones anteriores a 5.3.4 permite a atacantes dependientes del contexto provocar una denegación de servicio (caída de la aplicación) a través de un largo número de pasos anti-aliasing en un argumento para la función imagepstext. • http://bugs.php.net/53492 http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://seclists.org/fulldisclosure/2010/Dec/180 http://www.php.net/ChangeLog-5.php http://www.securityfocus.com/bid/45338 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11939 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 2%CPEs: 22EXPL: 4CVE-2010-4645 – PHP 5.3.2 - 'zend_strtod()' Floating-Point Value Denial of Service
https://notcve.org/view.php?id=CVE-2010-4645
strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308. strtod.c, tal como se utiliza en la función zend_strtod en PHP v5.2 anterior de v5.2.17 y v5.3 anterior de v5.3.5, y otros productos, permite a atacantes dependientes del contexto provocar una denegación de servicio (bucle infinito) a través de un cierto valor de punto flotante en notación científica, que no se manipula correctamente en los registros FPU x87. • https://www.exploit-db.com/exploits/35164 http://bugs.php.net/53632 http://hal.archives-ouvertes.fr/docs/00/28/14/29/PDF/floating-point-article.pdf http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053333.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053355.html http://marc.info/?l=bugtraq&m=133226187115472&w=2 http://marc.info/?l=bugtraq&m=13346920862250 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 0%CPEs: 108EXPL: 1CVE-2006-7243 – php: paths with NULL character were considered valid
https://notcve.org/view.php?id=CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function. PHP anterior a v5.3.4 acepta el caracter \0 en un nombre de ruta, lo que podría permitir a atacantes dependientes de contexto eludir las restricciones de acceso colocando una extensión de archivo después de este caracter, como se demuestra con .php\0.jpg al final del argumento de la función file_exists. • http://bugs.php.net/39863 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158616.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158915.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/159031.html http://marc.info/?l=bugtraq&m=132871655717248&w=2 http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://openwall.com/lists/oss-security/2010/11/18&# • CWE-20: Improper Input Validation CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 5.0EPSS: 2%CPEs: 69EXPL: 2CVE-2010-4409 – PHP 5.3.3 - NumberFormatter::getSymbol Integer Overflow
https://notcve.org/view.php?id=CVE-2010-4409
Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument. Desbordamienteo de entero en la función NumberFormatter::getSymbol (numfmt_get_symbol) de PHP 5.3.3 y versiones anteriores. Permite a atacantes dependiendo del contexto provocar una denegación de servicio (caída de la aplicación) a través de un argumento inválido. PHP version 5.3.3 suffers from a NumberFormatter::getSymbol integer overflow vulnerability. • https://www.exploit-db.com/exploits/15722 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html http://lists.opensuse.org/opensuse-updates/2012-01/msg00035.html http://secunia.com/advisories/42812 http://secunia.com/advisories/47674 http://support.apple.com/kb/HT4581 http://svn.php.net/viewvc/php/php-src& • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 1%CPEs: 14EXPL: 0CVE-2010-4150
https://notcve.org/view.php?id=CVE-2010-4150
Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors. Doble vulnerabilidad en la función imap_do_open en la extensión IMAP (ext/IMAP/php_imap.c) en PHP v5.2 antes de v5.2.15 y v5.3 antes de v5.3.4 permite a atacantes provocar una denegación de servicio (por corrupción de memoria) o posiblemente ejecutar código de su elección a través de vectores no especificados. • http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://secunia.com/advisories/42729 http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.490619 http://support.apple.com/kb/HT4581 http://svn.php.net/viewvc?view=revision&am • CWE-399: Resource Management Errors •