CVSS: 5.0EPSS: 1%CPEs: 3EXPL: 0CVE-2010-3062
https://notcve.org/view.php?id=CVE-2010-3062
mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the php_mysqlnd_ok_read function; or (2) trigger a heap-based buffer overflow via a modified length value, which is not properly handled by the php_mysqlnd_rset_header_read function. mysqlnd_wireprotocol.c en la extensión Mysqlnd en PHP v5.3 hasta v5.3.2 permite a atacantes remotos (1)leer memoria sensible a através de un valor de longitud manipulado, no siendo manejado adecuadamente por la función php_mysqlnd_ok_read; o (2) desencadenando un desbordamiento de búfer basado en memoria dinámica a través de un valor de longitud modificado, no siendo manejado adecuadamente por la función php_mysqlnd_rset_header_read. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://php-security.org/2010/05/31/mops-2010-056-php-php_mysqlnd_ok_read-information-leak-vulnerability/index.html http://php-security.org/2010/05/31/mops-2010-057-php-php_mysqlnd_rset_header_read-buffer-overflow-vulnerability/index.html http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?r1=298701&r2=298703&pathrev=298703 http:/&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 17EXPL: 1CVE-2010-3065 – php: session serializer session data injection vulnerability (MOPS-2010-060)
https://notcve.org/view.php?id=CVE-2010-3065
The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name. El serializador de sesión por defecto en PHP v5.2 hasta v5.2.13 y v5.3 hasta v5.3.2 no maneja adecuadamente PS_UNDEF_MARKER marker, lo que permite dependiendo del contexto a atacantes modificar variables de sesión de su elección a través de un nombre de variable de sesión manipulado. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://php-security.org/2010/05/31/mops-2010-060-php-session-serializer-session-data-injection-vulnerability/index.html http://secunia.com/advisories/42410 http://www.debian.org/security/2010/dsa-2089 http://www.redhat.com/support/errata/RHSA-2010-0919.html http://www.vupen.com/english/advisories/2010/3081 https://access.redhat.com/security • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3063
https://notcve.org/view.php?id=CVE-2010-3063
The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used. La función php_mysqlnd_read_error_from_line en la extensión Mysqlnd en PHP v5.3 hasta v5.3.2 no calcula adecuadamente la longitud del búfer, lo que permite a atacantes dependiendo del contexto desencadenar un desbordamiento de búfer basado en memoria dinámica a través de entradas manipuladas que provocan que un valor de longitud negativo sea utilizado. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://php-security.org/2010/05/31/mops-2010-058-php-php_mysqlnd_read_error_from_line-buffer-overflow-vulnerability/index.html http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?r1=298701&r2=298703&pathrev=298703 http://svn.php.net/viewvc?view=revision&revision=298703 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3064
https://notcve.org/view.php?id=CVE-2010-3064
Stack-based buffer overflow in the php_mysqlnd_auth_write function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument to the (a) mysql_connect or (b) mysqli_connect function. Desbordamiento de búfer basado en pila en la función php_mysqlnd_auth_write en la extensión Mysqlnd en PHP v5.3 hasta v5.3.2 permite dependiendo del contexto a atacantes provocar una denegación de servicio (caída) y posiblemente ejecutar código de su elección a través de un 1) nombre de usuario o (2) argumento de nombre de base de datos a (a) mysql_connect o (b) mysqli_connect function largo. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://php-security.org/2010/05/31/mops-2010-059-php-php_mysqlnd_auth_write-stack-buffer-overflow-vulnerability/index.html http://svn.php.net/viewvc/php/php-src/branches/PHP_5_3/NEWS?r1=298701&r2=298703&pathrev=298703 http://svn.php.net/viewvc?view=revision&revision=298703 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 0%CPEs: 13EXPL: 0CVE-2010-2484
https://notcve.org/view.php?id=CVE-2010-2484
The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. La función strrchr en PHP v5.2 anterior a v5.2.14 permite dependiendo del contexto a atacantes obtener información sensible (contenido de la memoria) o desencadenar un consumo de memoria provocando una interrepcuón del espacio de usuario de un controlador o una función interna. • http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00000.html http://marc.info/?l=bugtraq&m=133469208622507&w=2 http://support.apple.com/kb/HT4312 http://support.apple.com/kb/HT4435 http://www.php.net/releases/5_2_14.php https://bugzilla.redhat.com/show_bug.cgi?id=619324 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •