CVSS: 5.0EPSS: 4%CPEs: 16EXPL: 0CVE-2008-3660 – php: FastCGI module DoS via multiple dots preceding the extension
https://notcve.org/view.php?id=CVE-2008-3660
PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php. PHP 4.4.x en versiones anteriores a PHP 4.4.9 y 5.2.6 a través de 5.6, cuando se utiliza como un módulo FastCGI, permite a atacantes remotos provocar una denegación de servicio (con caida de la aplicación) a través de una solicitud con varios puntos precediendo a la extensión, como se demuestra usando foo..php. • http://bugs.gentoo.org/show_bug.cgi?id=234102 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://marc.info/?l=bugtraq&m=124654546101607&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://secunia.com/advisories/31982 http://secunia.com/advisories/32148 http://secunia.com/advisories/32746 http://secunia.com/advisories/35074 http://secunia.com/advisories/35306 h • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 3%CPEs: 16EXPL: 0CVE-2008-3659
https://notcve.org/view.php?id=CVE-2008-3659
Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible. Un desbordamiento de búfer en la función memnstr en versiones de PHP 4.4.x anteriores a 4.4.9 y en PHP 5.6 permite a atacantes provocar una denegación de servicio (con caida de la aplicación) y posiblemente ejecutar código arbitrario a través del argumento delimiter de la función a explotar. NOTA: el alcance de esta cuestión es limitado, ya que la mayoría de las aplicaciones no usan un delimitador controlado por un atacante, pero los ataques locales contra los safe_mode son viables. • http://bugs.gentoo.org/show_bug.cgi?id=234102 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00006.html http://marc.info/?l=bugtraq&m=124654546101607&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://news.php.net/php.cvs/52002 http://osvdb.org/47483 http://secunia.com/advisories/31982 http:/&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 1%CPEs: 7EXPL: 0CVE-2008-2829
https://notcve.org/view.php?id=CVE-2008-2829
php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function. El archivo php_imap.c en PHP versiones 5.2.5, 5.2.6, 4.x y otras versiones, utiliza llamadas API obsoletas que permiten a los atacantes dependiendo del contexto causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario por medio de una larga petición IMAP, que activa un mensaje de error "rfc822.c legacy routine buffer overflow", relacionado con la función rfc822_write_address. • http://bugs.php.net/bug.php?id=42862 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html http://marc.info/?l=bugtraq&m=124654546101607&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://osvdb.org/46641 http://secunia.com/advisories/31200 http://secunia.com/advisories/32746 http://secunia.com/advisories/35074 http://secunia.com/advisories/35306 http://secunia. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 23EXPL: 1CVE-2008-2666 – PHP 5.2.6 - 'chdir()' Function http URL Argument Safe_mode Restriction Bypass
https://notcve.org/view.php?id=CVE-2008-2666
Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok function. Múltiples vulnerabilidades de Salto de Directorio en PHP 5.2.6 permiten a los atacantes según contexto saltarse las restricciones safe_mode creando un subdirectorio denominado http: y colocando después secuencias ../ (punto punto barra) en un argumento http URL en la función (1) chdir o (2) ftok. • https://www.exploit-db.com/exploits/31937 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://marc.info/?l=bugtraq&m=124654546101607&w=2 http://marc.info/?l=bugtraq&m=125631037611762&w=2 http://secunia.com/advisories/32746 http://secunia.com/advisories/35074 http://secunia.com/advisories/35650 http://security.gentoo.org/glsa/glsa-200811-05.xml http://securityreason.com/achievement_securityalert/55 http://securityreason.com/securityalert/3942 http: • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 2CVE-2008-2108 – PHP weak 64 bit random seed
https://notcve.org/view.php?id=CVE-2008-2108
The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions. La macro GENERATE_SEED de PHP 4.x versiones anteriores a la 4.4.8 y 5.x versiones anteriores a la 5.2.5, cuando se ejecuta en sistemas de 64 bits, realiza un producto que genera una porción de bits cero durante la conversión debido a la falta de precisión, lo que provoca 24 bits de entropía y simplifican los ataques por fuerza bruta contra mecanismos de protección que utilizan la secuencia generada y las funciones mt-rand. • http://archives.neohapsis.com/archives/fulldisclosure/2008-05/0103.html http://secunia.com/advisories/30757 http://secunia.com/advisories/30828 http://secunia.com/advisories/31119 http://secunia.com/advisories/31124 http://secunia.com/advisories/31200 http://secunia.com/advisories/32746 http://secunia.com/advisories/35003 http://security.gentoo.org/glsa/glsa-200811-05.xml http://securityreason.com/securityalert/3859 http://www.debian.org/security/2009/dsa-1789 http://www.man • CWE-331: Insufficient Entropy •