CVSS: 4.6EPSS: 0%CPEs: 2EXPL: 2CVE-2007-1484 – PHP 4.4.6/5.2.1 - 'array_user_key_compare()' ZVAL dtor Local Overflow
https://notcve.org/view.php?id=CVE-2007-1484
The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called. La función array_user_key_compare en PHP 4.4.6 y anteriores, y 5.X hasta la 5.2.1, hace una llamada erronea a zval_dtor, lo cual dispara una corrupción de memoria y permite a usuarios locales evitar el safe_mode y ejecutar código de su elección a través de ciertas operaciones de desasignación después de que array_user_key_compare haya sido llamada. • https://www.exploit-db.com/exploits/3499 http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/24542 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http://secunia.com/advisories/25445 http://secunia.com/advisories/26235 http://security.gentoo.org/glsa/glsa-200705-19.xml http://us2.php.net/releases/4_4_7.php http://us2.php.net/releases& •
CVSS: 5.0EPSS: 1%CPEs: 63EXPL: 0CVE-2007-1460
https://notcve.org/view.php?id=CVE-2007-1460
The zip:// URL wrapper provided by the PECL zip extension in PHP before 4.4.7, and 5.2.0 and 5.2.1, does not implement safemode or open_basedir checks, which allows remote attackers to read ZIP archives located outside of the intended directories. La URL encapsulada zip:// proporcionada por la extensión zip PECL en PHP versiones anteriores a 4.4.7, y versiones 5.2.0 y 5.2.1, no implementa comprobaciones de safemode o open_basedir, lo que permite a atacantes remotos leer archivos ZIP ubicados fuera de los directorios previstos. • http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/25056 http://secunia.com/advisories/26235 http://us2.php.net/releases/4_4_7.php http://us2.php.net/releases/5_2_2.php http://www.novell.com/linux/security/advisories/2007_32_php.html http://www.php-security.org/MOPB/MOPB-20-2007.html http://www.securityfocus.com/bid/22954 http://www.securityfocus.com&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 1%CPEs: 76EXPL: 0CVE-2007-1461
https://notcve.org/view.php?id=CVE-2007-1461
The compress.bzip2:// URL wrapper provided by the bz2 extension in PHP before 4.4.7, and 5.x before 5.2.2, does not implement safemode or open_basedir checks, which allows remote attackers to read bzip2 archives located outside of the intended directories. La URL encapsulada compress.bzip2:// proporcionada por la extensión bz2 en PHP versiones anteriores a 4.4.7, y versiones 5.x anteriores a 5.2.2, no implementa comprobaciones de safemode o open_basedir, lo que permite a atacantes remotos leer archivos bzip2 ubicados fuera de los directorios previstos. • http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/25056 http://secunia.com/advisories/26235 http://us2.php.net/releases/4_4_7.php http://us2.php.net/releases/5_2_2.php http://www.novell.com/linux/security/advisories/2007_32_php.html http://www.php-security.org/MOPB/MOPB-21-2007.html http://www.securityfocus.com/bid/22954 http://www.securityfocus.com&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 2EXPL: 4CVE-2007-1413 – PHP 4.4.6 - 'snmpget()' Object id Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-1413
Buffer overflow in the snmpget function in the snmp extension in PHP 5.2.3 and earlier, including PHP 4.4.6 and probably other PHP 4 versions, allows context-dependent attackers to execute arbitrary code via a long value in the third argument (object id). Un desbordamiento de búfer en la función snmpget en la extensión snmp en PHP versión 5.2.3 y anteriores, incluyendo a PHP versión 4.4.6 y probablemente otras versiones 4 de PHP, permite a atacantes dependiendo del contexto ejecutar código arbitrario por medio de un valor largo en el tercer argumento (id del objeto). • https://www.exploit-db.com/exploits/3439 https://www.exploit-db.com/exploits/4274 https://www.exploit-db.com/exploits/4204 http://retrogod.altervista.org/php_446_snmpget_local_bof.html http://secunia.com/advisories/24440 http://www.securityfocus.com/bid/22893 https://exchange.xforce.ibmcloud.com/vulnerabilities/35517 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 10%CPEs: 1EXPL: 3CVE-2007-1411 – PHP 4.4.6 - 'mssql_[p]connect()' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-1411
Buffer overflow in PHP 4.4.6 and earlier, and unspecified PHP 5 versions, allows local and possibly remote attackers to execute arbitrary code via long server name arguments to the (1) mssql_connect and (2) mssql_pconnect functions. Desbordamiento de búfer en PHP 4.4.6 y versiones anteriores, y versiones no especificadas de PHP 5, permite a usuarios locales y posiblemente remotos ejecutar código de su elección mediante argumentos de nombre de servidor larga en las funciones (1) mssql_connect y (2) mssql_pconnect. • https://www.exploit-db.com/exploits/3417 http://retrogod.altervista.org/php_446_mssql_connect_bof.html http://secunia.com/advisories/24353 http://securityreason.com/securityalert/2407 http://www.securityfocus.com/archive/1/462010/100/0/threaded http://www.securityfocus.com/bid/22832 http://www.vupen.com/english/advisories/2007/0867 https://exchange.xforce.ibmcloud.com/vulnerabilities/32885 •