CVSS: 5.0EPSS: 9%CPEs: 10EXPL: 0CVE-2009-1271 – php: crash on malformed input in json_decode()
https://notcve.org/view.php?id=CVE-2009-1271
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function. La función JSON_parser (ext/json/JSON_parser.c) en PHP v5.2.x anteriores a v5.2.9 permite a atacantes remotos provocar una denegación de servicio (falta de segmentación) a través de una cadena formada de forma incorrecta a la función API json_decode. • http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15 http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/34770 http://secunia.com/advisories/34830 http://secunia.com/advisories/34933 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35306 http://secunia.com •
CVSS: 5.0EPSS: 1%CPEs: 10EXPL: 0CVE-2009-1272
https://notcve.org/view.php?id=CVE-2009-1272
The php_zip_make_relative_path function in php_zip.c in PHP 5.2.x before 5.2.9 allows context-dependent attackers to cause a denial of service (crash) via a ZIP file that contains filenames with relative paths, which is not properly handled during extraction. La función php_zip_make_relative_path en php_zip.c en PHP v5.2.x anteriores a v5.2.9 permite a atacantes, dependiendo del contexto, provocar una denegación de servicio (caída) a través de una fichero ZIP que contiene nombres de ficheros con las rutas relativas, lo que no está bien manejado durante la extracción. • http://cvs.php.net/viewvc.cgi/php-src/ext/zip/php_zip.c?r1=1.1.2.48&r2=1.1.2.49 http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://marc.info/?l=bugtraq&m=125017764422557&w=2 http://secunia.com/advisories/35685 http://secunia.com/advisories/36701 http://support.apple.com/kb/HT3865 http://www.openwall.com/lists/oss-security/2009/04/01/9 http://www& • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 3EXPL: 2CVE-2009-0754 – PHP 5.2.5 - 'mbstring.func_overload' WebServer Denial of Service
https://notcve.org/view.php?id=CVE-2009-0754
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server. PHP v4.4.4, v5.1.6, y otras versiones, cuando están ejecutando Apache, permite a usuarios locales modificar el comportamiento de otros sitios hospedados en el mismo servidor web mediante la modificación de la característica mbstring.func_overload dentro de .htaccess, lo que produce que esta característica sea aplicada a otros sistemas virtuales alojados en el mismo servidor. • https://www.exploit-db.com/exploits/32769 http://bugs.php.net/bug.php?id=27421 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://secunia.com/advisories/34642 http://secunia.com/advisories/34830 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35306 http://www.debian.org/security/2009/dsa-1789 http://www.openwall.com/lists/oss-security/2009/01/30/1 http://www.openwall.com/lists • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2008-5844
https://notcve.org/view.php?id=CVE-2008-5844
PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it easier for context-dependent attackers to conduct SQL injection attacks and unspecified other attacks. PHP v5.2.7 contiene un cambio incorrecto de la funcionalidad FILTER_UNSAFE_RAW, y de forma no intencionada desactiva la opción magic_quotes_gpc, sin importar la actual configuración de magic_quotes_gpc, lo cual facilita a los atacantes, dependiendo del contexto, provocar ataques de inyección SQL y otros ataques no especificados. • http://bugs.php.net/bug.php?id=42718 http://bugs.php.net/bug.php?id=46759 http://www.php.net/ChangeLog-5.php#5.2.8 http://www.php.net/archive/2008.php#id2008-12-07-1 http://www.php.net/archive/2008.php#id2008-12-08-1 http://www.securityfocus.com/bid/32673 http://www.securitytracker.com/id?1021393 • CWE-16: Configuration •
CVSS: 2.6EPSS: 0%CPEs: 109EXPL: 0CVE-2008-5814 – php: XSS via PHP error messages
https://notcve.org/view.php?id=CVE-2008-5814
Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208. Vulnerabilidad de Secuencias de Comandos en Sitios Cruzados (XSS) en PHP, posiblemente v5.2.7 y anteriores, cuando display_error está activada, permite a atacantes remotos inyectar secuencias de comandos Web o HTML a través de vectores no especificados. NOTA: debido a la falta de detalles, no está claro si esto está relacionado con CVE-2006-0208. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 http://jvn.jp/en/jp/JVN50327700/index.html http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html http://marc.info/?l=bugtraq&m=124277349419254&w=2 http://secunia.com/advisories/34830 http://secunia.com/advisories/34933 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35108 http://www.debian.org/security/2009/dsa-1789 http://www • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •