CVSS: 10.0EPSS: 2%CPEs: 4EXPL: 0CVE-2006-4485
https://notcve.org/view.php?id=CVE-2006-4485
31 Aug 2006 — The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read. La función stripos en PHP anterior a 5.1.5 tiene impacto desconocido y vectores de ataque relacionados con una lectura fuera de rango. • http://rhn.redhat.com/errata/RHSA-2006-0688.html •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2006-4481
https://notcve.org/view.php?id=CVE-2006-4481
31 Aug 2006 — The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows local users to bypass the settings. NOTE: the error_log function is covered by CVE-2006-3011, and the imap_open function is covered by CVE-2006-1017. Las funciones (1) file_exists y (2) imap_reopen en PHP before 5.1.5 no validan para las configuraciones safe_mode y open_basedir, lo cual permite a un usuario local evitar las configuraciones. NOTA: la función error_log e... • http://secunia.com/advisories/21546 •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2006-4486
https://notcve.org/view.php?id=CVE-2006-4486
31 Aug 2006 — Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction. Desbordamiento de enteros en rutinas de asignación de memoria en PHP anterior a 5.1.6, cuando se ejecuta en sistemas de 64 bits, permite a atacantes dependientes de contexto evitar la restricción memory_limit. • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc • CWE-189: Numeric Errors •
CVSS: 9.8EPSS: 19%CPEs: 4EXPL: 1CVE-2006-4484 – gd: GIF handling buffer overflow
https://notcve.org/view.php?id=CVE-2006-4484
31 Aug 2006 — Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array. Desbordamiento de búfer en la función LWZReadByte_ en ext/gd/libgd/gd_gif_in.c en la extensión GD en PHP anterior a 5.1.5 permite a atacantes remotos tener un impacto desconocido mediante un fichero GIF con input_code_size m... • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc •
CVSS: 9.3EPSS: 11%CPEs: 1EXPL: 0CVE-2006-4483
https://notcve.org/view.php?id=CVE-2006-4483
31 Aug 2006 — The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache. Los ficheros con extensión cURL (1) ext/curl/interface.c y(2) ext/curl/streams.c en PHP anterior a 5.1.5 permite la opción CURLOPT_FOLLOWLOCATION cuando open_basedir o safe_mode está habilitado, lo cual permite a un atacante realizar a... • http://cvs.php.net/viewcvs.cgi/php-src/ext/curl/interface.c?r1=1.62.2.14.2.6&r2=1.62.2.14.2.7 • CWE-862: Missing Authorization •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2006-4482
https://notcve.org/view.php?id=CVE-2006-4482
31 Aug 2006 — Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990. Múltiples vulnerabilidades de desbordamiento de búfer en las funciones (1) str_repeat y (2) wordwrap en ext/standard/string.c en PHP anterior a 5.1.5, cuando se uso sobre sistemas de 64-bit, tiene un impacto desconocido y ataque a vectores, una vulnerabilidad ... • ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 3%CPEs: 65EXPL: 0CVE-2006-4433
https://notcve.org/view.php?id=CVE-2006-4433
29 Aug 2006 — PHP before 4.4.3 and 5.x before 5.1.4 does not limit the character set of the session identifier (PHPSESSID) for third party session handlers, which might make it easier for remote attackers to exploit other vulnerabilities by inserting PHP code into the PHPSESSID, which is stored in the session file. NOTE: it could be argued that this not a vulnerability in PHP itself, rather a design limitation that enables certain attacks against session handlers that do not account for this limitation. PHP anterior a 4.... • http://secunia.com/advisories/21573 •
CVSS: 9.8EPSS: 1%CPEs: 3EXPL: 2CVE-2006-4023
https://notcve.org/view.php?id=CVE-2006-4023
09 Aug 2006 — The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a valid network IP address, which allows remote attackers to obtain network information and facilitate other attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0. NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way that is similar to strcpy's role in buffer overflows, in which case this would be a class o... • http://retrogod.altervista.org/php_ip2long.htm •
CVSS: 9.8EPSS: 0%CPEs: 67EXPL: 4CVE-2006-4020 – PHP 4.4.3/5.1.4 - 'sscanf' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2006-4020
08 Aug 2006 — scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read. scanf.c en PHP 5.1.4 y anteriores, y 4.4.3 y anteriores, permite a atacantes (locales o remotos dependiendo del contexto) ejecutar código de su elección mediante una llamada a la función sscanf de PHP que realiza un intercambio de argumentos que ... • https://www.exploit-db.com/exploits/2193 •
CVSS: 7.8EPSS: 0%CPEs: 77EXPL: 2CVE-2006-3011 – PHP 5.2.6 - 'error_log' Safe_mode Bypass
https://notcve.org/view.php?id=CVE-2006-3011
26 Jun 2006 — The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode. La función error_log en basic_functions.c en PHP anterior v4.4.4 y v5.x anterior v5.1.5 permite a usuarios locales superar el modo de seguridad y las restricciones open_basedir a través de un "php://" u otros esquemas en el tercer argumento, que deshabilitan el modo seguro. • https://www.exploit-db.com/exploits/7171 • CWE-264: Permissions, Privileges, and Access Controls •