CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 3CVE-2010-2097
https://notcve.org/view.php?id=CVE-2010-2097
The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature. Las funciones (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode en PHP v5.2 a la v5.2.13 y v5.3 a la v5.3.2, permiten a atacantes dependientes del contexto obtener información sensible (contenido de la memoria) provocando una interrupción del espacio de usuario de una función interna. Relacionado con la llamada por referencia de la funcionalidad "time pass". • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://php-security.org/2010/05/18/mops-2010-032-php-iconv_mime_decode-interruption-information-leak-vulnerability/index.html http://php-security.org/2010/05/18/mops-2010-033-php-iconv_substr-interruption-information-leak-vulnerability/index.html http://php-security.org/2010/05/18/mops-2010-034- • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 1CVE-2010-2093
https://notcve.org/view.php?id=CVE-2010-2093
Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs. Vulnerabilidad de uso despues de liberacion en la funcionalidad de petición shutdown en PHP v5.2 anterior v5.2.13 y v5.3 anterior v5.3.2 permite a atacantes dependientes del contexto causar una denegación de servicio (caída) a través de una estructura cadena de contexto que es liberada antes de que ocurra la destrucción. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://php-security.org/2010/05/12/mops-2010-022-php-stream-context-use-after-free-on-request-shutdown-vulnerability/index.html • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 5CVE-2010-2100
https://notcve.org/view.php?id=CVE-2010-2100
The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature. Las funciones (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, y (6) strtr en PHP v5.2 hasta v5.2.13 y v5.3 hasta v5.3.2 permite a atacantes dependientes del contexto obtener información sensible (contenidos de memoria) provocando una interrupción del espacio de usuario de una función interna, relativo a la característica paso de tiempo de llamada por referencia. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://php-security.org/2010/05/21/mops-2010-036-php-htmlentities-and-htmlspecialchars-interruption-information-leak-vulnerability/index.html http://php-security.org/2010/05/21/mops-2010-037-php-str_getcsv-interruption-information-leak-vulnerability/index.html http://php-security.org/2010/05/21/mops-20 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 1%CPEs: 16EXPL: 1CVE-2010-1917 – php: fnmatch long pattern stack memory exhaustion (MOPS-2010-021)
https://notcve.org/view.php?id=CVE-2010-1917
Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string. Una vulnerabilidad de consumo de pila en PHP v5.2 a v5.2.13 y v5.3 a través de v5.3.2 permite provocar, a determinados atacantes, según el contexto, una denegación de servicio (fallo de PHP) a través de un argumento modificado a la función fnmatch, como se demuestra mediante una cadena larga en ese argumento. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=bugtraq&m=130331363227777&w=2 http://secunia.com/advisories/40860 http://secunia.com/advisories/42410 http://www.debian.org/security/2010/dsa-2089 http://www.php-security.org/2010/05/11/mops-2010-021-php-fnmatch-stack-exhaustion-vulnerability/index.html http://www.redhat.com/support/errata/RHSA-2010-0919.html http& • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 0%CPEs: 16EXPL: 0CVE-2010-1915
https://notcve.org/view.php?id=CVE-2010-1915
The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory. La función preg_quote en PHP v5.2 hasta v.5.2.13 y v5.3 hasta v.5.3.2 permite a atacantes, dependiendo del contexto obtener información sensible (contenido de memoria) provocando una interrupción del espacio de usuario de una función interna relativa, a la característica paso de tiempo de llamada por referencia, modificando ZVALs cuyos valores no son actualizados en la asociación local de variables, y accede a memoria previamente liberada. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://www.php-security.org/2010/05/09/mops-2010-017-php-preg_quote-interruption-information-leak-vulnerability/index.html https://exchange.xforce.ibmcloud.com/vulnerabilities/58586 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •