CVSS: 4.7EPSS: 0%CPEs: 13EXPL: 0CVE-2018-10545 – php: Dumpable FPM child processes allow bypassing opcache access controls
https://notcve.org/view.php?id=CVE-2018-10545
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process. Se ha descubierto un problema en PHP en versiones anteriores a la 05/06/1935, versiones 7.0.x anteriores a la 7.0.29, versiones 7.1.x anteriores a la 07/01/2016 y versiones 7.2.x anteriores a la 7.2.4. Los procesos hijo FPM volcables permiten la omisión de los controles de acceso de opcache debido a que fpm_unix.c realiza una llamada prctl PR_SET_DUMPABLE, que permite que un usuario (en un entorno multiusuario) obtenga información sensible de la memoria del proceso de las aplicaciones PHP de un segundo usuario ejecutando gcore en el PID del proceso trabajador PHP-FPM. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/104022 https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=75605 https://lists.debian.org/debian-lts-announce/2018/05/msg00004.html https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html https://security.gentoo.org/glsa/201812-01 https://security.netapp.com/advisory/ntap-20180607-0003 https://usn.ubuntu.com/3646-1 https:// • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 2%CPEs: 11EXPL: 1CVE-2018-10546 – php: Infinite loop in ext/iconv/iconv.c when using stream filter with convert.incov on invalid sequence leads to denial-of-service
https://notcve.org/view.php?id=CVE-2018-10546
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences. Se ha descubierto un problema en PHP en versiones anteriores a la 5.6.36, versiones 7.0.x anteriores a la 7.0.30, versiones 7.1.x anteriores a la 7.1.17 y versiones 7.2.x anteriores a la 7.2.5. Existe un bucle infinito en ext/iconv/iconv.c debido a que el filtro de transmisiones iconv no rechaza las secuencias multibyte no válidas. An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. • https://github.com/dsfau/CVE-2018-10546 http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/104019 http://www.securitytracker.com/id/1040807 https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=76249 https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html https://security.gentoo.org/glsa/201812-01 https://security.netapp.com/advisory/ntap-20180607-0003 https://usn.ubuntu.com/364 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 6.1EPSS: 3%CPEs: 13EXPL: 0CVE-2018-10547 – php: Reflected XSS vulnerability on PHAR 403 and 404 error pages
https://notcve.org/view.php?id=CVE-2018-10547
An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712. Se ha descubierto un problema en ext/phar/phar_object.c en PHP en versiones anteriores a la 5.6.36, versiones 7.0.x anteriores a la 7.0.30, versiones 7.1.x anteriores a la 7.1.17 y versiones 7.2.x anteriores a la 7.2.5. Hay XSS reflejado en las página de error 403 y 404 de PHAR mediante los datos de petición de una petición de un archivo .phar. • http://php.net/ChangeLog-5.php http://php.net/ChangeLog-7.php http://www.securitytracker.com/id/1040807 https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=76129 https://lists.debian.org/debian-lts-announce/2018/05/msg00004.html https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html https://security.netapp.com/advisory/ntap-20180607-0003 https://usn.ubuntu.com/3646-1 https://usn.ubuntu.com/3646-2 https://www.debian& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 75%CPEs: 11EXPL: 1CVE-2018-7584 – PHP 7.2.2 - 'php_stream_url_wrap_http_ex' Buffer Overflow
https://notcve.org/view.php?id=CVE-2018-7584
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. En PHP hasta la versión 5.6.33, versiones 7.0.x anteriores a la 7.0.28, versiones 7.1.x hasta la 7.1.14 y versiones 7.2.x hasta la 7.2.2, hay una sublectura de búfer basada en pila al analizar una respuesta HTTP en la función php_stream_url_wrap_http_ex en ext/standard/http_fopen_wrapper.c. Esto resulta en la copia de una cadena larga. PHP version 7.2.2 contains a memory corruption bug while parsing malformed HTTP response packets. • https://www.exploit-db.com/exploits/44846 http://php.net/ChangeLog-7.php http://www.securityfocus.com/bid/103204 http://www.securitytracker.com/id/1041607 https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=75981 https://github.com/php/php-src/commit/523f230c831d7b33353203fa34aee4e92ac12bba https://lists.debian.org/debian-lts-announce/2018/03/msg00030.html https://lists.debian.org/debian-lts-announce/2018/06/msg00005.html https://usn.ubuntu.com/ • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125: Out-of-bounds Read •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 4CVE-2015-9253
https://notcve.org/view.php?id=CVE-2015-9253
An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility. Se ha descubierto un problema en PHP en versiones 7.3.x anteriores a la 7.3.0alpha3, versiones 7.2.x anteriores a la 7.2.8 y anteriores a la 7.1.20. El proceso maestro php-fpm reinicia un proceso hijo en un bucle infinito cuando se utilizan funciones de ejecución de programas (por ejemplo, passthru, exec, shell_exec o system) con un flujo non-blocking-STDIN y consumir el espacio del disco con un gran volumen de logs de error, tal y como queda demostrado con un ataque a un cliente de una instalación de alojamiento compartido. • https://bugs.php.net/bug.php?id=70185 https://bugs.php.net/bug.php?id=73342https://github.com/php/php-src/pull/3287 https://bugs.php.net/bug.php?id=75968 https://github.com/php/php-src/blob/PHP-7.1.20/NEWS#L20-L22 https://github.com/php/php-src/commit/69dee5c732fe982c82edb17d0dbc3e79a47748d8 https://usn.ubuntu.com/3766-1 https://usn.ubuntu.com/4279-1 https://www.futureweb.at/security/CVE-2015-9253 • CWE-400: Uncontrolled Resource Consumption •