CVSS: 5.0EPSS: 0%CPEs: 20EXPL: 0CVE-2014-2020
https://notcve.org/view.php?id=CVE-2014-2020
ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a (1) string or (2) array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a different vulnerability than CVE-2013-7226. ext/gd/gd.c en PHP 5.5.x anterior a 5.5.9 no comprueba tipos de datos, lo que podría permitir a atacantes remotos obtener información sensible mediante el uso de (1) una cadena o (2) un tipo de dato array en lugar de un tipo de dato numérico, tal y como se demostró mediante la llamada de la función imagecrop con una cadena para el valor de dimensión x, una vulnerabilidad diferente a CVE-2013-7226. • http://www.ubuntu.com/usn/USN-2126-1 https://bugs.php.net/bug.php?id=66356 https://github.com/php/php-src/commit/2938329ce19cb8c4197dec146c3ec887c6f61d01 • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 4%CPEs: 9EXPL: 0CVE-2014-1943 – file: unrestricted recursion in handling of indirect type rules
https://notcve.org/view.php?id=CVE-2014-1943
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file. Fine Free File anterior a 5.17 permite a atacantes dependientes de contexto causar una denegación de servicio (recursión infinita, consumo de CPU y caída) a través de un valor manipulado de desplazamiento indirecto en el "magic" de un archivo. A denial of service flaw was found in the way the File Information (fileinfo) extension handled indirect rules. A remote attacker could use this flaw to cause a PHP application using fileinfo to crash or consume an excessive amount of CPU. • http://lists.opensuse.org/opensuse-updates/2014-03/msg00034.html http://lists.opensuse.org/opensuse-updates/2014-03/msg00037.html http://mx.gw.com/pipermail/file/2014/001327.html http://mx.gw.com/pipermail/file/2014/001330.html http://mx.gw.com/pipermail/file/2014/001334.html http://mx.gw.com/pipermail/file/2014/001337.html http://rhn.redhat.com/errata/RHSA-2014-1765.html http://support.apple.com/kb/HT6443 http://www.debian.org/security/2014/dsa-2861 http:& • CWE-755: Improper Handling of Exceptional Conditions CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 5.0EPSS: 0%CPEs: 112EXPL: 0CVE-2012-1171
https://notcve.org/view.php?id=CVE-2012-1171
The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper. La función libxml RSHUTDOWN en PHP 5.x permite a atacantes remotos evadir el mecanismo de protección de open_basedir y leer archivos arbitrarios a través de vectores que incolucran la llamada del método stream_close durante el uso de un "wrapper" de transmisión personalizado. • https://bugs.php.net/bug.php?id=61367 https://bugzilla.redhat.com/show_bug.cgi?id=802591 https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-read.phpt https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-write.phpt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 4%CPEs: 20EXPL: 0CVE-2013-7226
https://notcve.org/view.php?id=CVE-2013-7226
Integer overflow in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an imagecrop function call with a large x dimension value, leading to a heap-based buffer overflow. Desbordamiento de enteros en la función gdImageCrop en ext/gd/gd.c en PHP 5.5.x anterior a 5.5.9 permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente tener otro impacto no especificado a través de una llamada de la función imagecrop con un valor de dimensión x grande, que conduce a un desbordamiento de buffer basado en memoria dinámica. • http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=8f4a5373bb71590352fd934028d6dde5bc18530b http://secunia.com/advisories/56829 http://www.mandriva.com/security/advisories?name=MDVSA-2014:027 http://www.php.net/ChangeLog-5.php http://www.securityfocus.com/bid/65533 http://www.securitytracker.com/id/1029767 http://www.ubuntu.com/usn/USN-2126-1 https://bugs.php.net/bug.php?id=66356 https://bugzilla.redhat.com/show_bug.cgi?id=1065108 https://exchange.xforce.ibmcloud.com/vulnera • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 95%CPEs: 81EXPL: 2CVE-2013-6420 – PHP - 'openssl_x509_parse()' Memory Corruption
https://notcve.org/view.php?id=CVE-2013-6420
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function. La función asn1_time_to_time_t en ext / openssl / openssl.c en PHP anterior a 5.3.28, 5.4.x aterior a 5.4.23 y 5.5.x anterior de 5.5.7 no trata correctamente las marcas de tiempo (timestamps) (1) notBefore y (2) notAfter en certificados X 0.509 , lo que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un certificado manipulado que no está tratado adecuadamente por la función openssl_x509_parse. The PHP function openssl_x509_parse() uses a helper function called asn1_time_to_time_t() to convert timestamps from ASN1 string format into integer timestamp values. The parser within this helper function is not binary safe and can therefore be tricked to write up to five NUL bytes outside of an allocated buffer. This problem can be triggered by x509 certificates that contain NUL bytes in their notBefore and notAfter timestamp fields and leads to a memory corruption that might result in arbitrary code execution. • https://www.exploit-db.com/exploits/30395 http://forums.interworx.com/threads/8000-InterWorx-Version-5-0-14-Released-on-Beta-Channel%21 http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=c1224573c773b6845e83505f717fbf820fc18415 http://lists.opensuse.org/opensuse-updates/2013-12/msg00125.html http://lists.opensuse.org/opensuse-updates/2013-12/msg00126.html http://rhn.redhat.com/errata/RHSA-2013-1813.html http://rhn.redhat.com/errata/RHSA-2013-1815.html http://rhn.redhat.com/errata/RHSA • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •