CVSS: 5.0EPSS: 9%CPEs: 10EXPL: 0CVE-2009-1271 – php: crash on malformed input in json_decode()
https://notcve.org/view.php?id=CVE-2009-1271
The JSON_parser function (ext/json/JSON_parser.c) in PHP 5.2.x before 5.2.9 allows remote attackers to cause a denial of service (segmentation fault) via a malformed string to the json_decode API function. La función JSON_parser (ext/json/JSON_parser.c) en PHP v5.2.x anteriores a v5.2.9 permite a atacantes remotos provocar una denegación de servicio (falta de segmentación) a través de una cadena formada de forma incorrecta a la función API json_decode. • http://cvs.php.net/viewvc.cgi/php-src/ext/json/JSON_parser.c?r1=1.1.2.14&r2=1.1.2.15 http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html http://secunia.com/advisories/34770 http://secunia.com/advisories/34830 http://secunia.com/advisories/34933 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35306 http://secunia.com •
CVSS: 2.1EPSS: 0%CPEs: 3EXPL: 2CVE-2009-0754 – PHP 5.2.5 - 'mbstring.func_overload' WebServer Denial of Service
https://notcve.org/view.php?id=CVE-2009-0754
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server. PHP v4.4.4, v5.1.6, y otras versiones, cuando están ejecutando Apache, permite a usuarios locales modificar el comportamiento de otros sitios hospedados en el mismo servidor web mediante la modificación de la característica mbstring.func_overload dentro de .htaccess, lo que produce que esta característica sea aplicada a otros sistemas virtuales alojados en el mismo servidor. • https://www.exploit-db.com/exploits/32769 http://bugs.php.net/bug.php?id=27421 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://secunia.com/advisories/34642 http://secunia.com/advisories/34830 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35306 http://www.debian.org/security/2009/dsa-1789 http://www.openwall.com/lists/oss-security/2009/01/30/1 http://www.openwall.com/lists • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2008-5844
https://notcve.org/view.php?id=CVE-2008-5844
PHP 5.2.7 contains an incorrect change to the FILTER_UNSAFE_RAW functionality, and unintentionally disables magic_quotes_gpc regardless of the actual magic_quotes_gpc setting, which might make it easier for context-dependent attackers to conduct SQL injection attacks and unspecified other attacks. PHP v5.2.7 contiene un cambio incorrecto de la funcionalidad FILTER_UNSAFE_RAW, y de forma no intencionada desactiva la opción magic_quotes_gpc, sin importar la actual configuración de magic_quotes_gpc, lo cual facilita a los atacantes, dependiendo del contexto, provocar ataques de inyección SQL y otros ataques no especificados. • http://bugs.php.net/bug.php?id=42718 http://bugs.php.net/bug.php?id=46759 http://www.php.net/ChangeLog-5.php#5.2.8 http://www.php.net/archive/2008.php#id2008-12-07-1 http://www.php.net/archive/2008.php#id2008-12-08-1 http://www.securityfocus.com/bid/32673 http://www.securitytracker.com/id?1021393 • CWE-16: Configuration •
CVSS: 2.6EPSS: 0%CPEs: 109EXPL: 0CVE-2008-5814 – php: XSS via PHP error messages
https://notcve.org/view.php?id=CVE-2008-5814
Cross-site scripting (XSS) vulnerability in PHP, possibly 5.2.7 and earlier, when display_errors is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: because of the lack of details, it is unclear whether this is related to CVE-2006-0208. Vulnerabilidad de Secuencias de Comandos en Sitios Cruzados (XSS) en PHP, posiblemente v5.2.7 y anteriores, cuando display_error está activada, permite a atacantes remotos inyectar secuencias de comandos Web o HTML a través de vectores no especificados. NOTA: debido a la falta de detalles, no está claro si esto está relacionado con CVE-2006-0208. • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444 http://jvn.jp/en/jp/JVN50327700/index.html http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000084.html http://marc.info/?l=bugtraq&m=124277349419254&w=2 http://secunia.com/advisories/34830 http://secunia.com/advisories/34933 http://secunia.com/advisories/35003 http://secunia.com/advisories/35007 http://secunia.com/advisories/35108 http://www.debian.org/security/2009/dsa-1789 http://www • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 33EXPL: 3CVE-2008-5498 – PHP 5.2.8 gd library - 'imageRotate()' Information Leak
https://notcve.org/view.php?id=CVE-2008-5498
Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image. Error de índice de array en la función imageRotate en PHP 5.2.8 y anteriores permite a atacantes dependientes del contexto leer los contenidos de posiciones de memoria de su elección mediante un valor manipulado del tercer argumento (también conocido como el argumento bgd_color o clrBack) para una imagen indexada. • https://www.exploit-db.com/exploits/7646 http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1360&r2=1.2027.2.547.2.1361&diff_format=u http://downloads.securityfocus.com/vulnerabilities/exploits/33002-2.php http://downloads.securityfocus.com/vulnerabilities/exploits/33002.php http://lists.apple.com/archives/security-announce/2009/Sep/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://marc.info/?l=bugtraq&m=124654546101607&w=2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •