CVSS: 4.3EPSS: 36%CPEs: 69EXPL: 1CVE-2007-3799 – PHP 5.2.3 - EXT/Session HTTP Response Header Injection
https://notcve.org/view.php?id=CVE-2007-3799
The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207. Una función session_start en ext/session en PHP versiones 4.x hasta 4.4.7 y versiones 5.x hasta 5.2.3, permite a atacantes remotos insertar atributos arbitrarios en la cookie de sesión por medio de caracteres especiales en una cookie que es obtenida de (1) PATH_INFO, (2) la función session_id, y (3) la función session_start, que no están codificadas o filtradas cuando es generado la nueva cookie de sesión, lo que constituye un problema relacionado con CVE-2006-0207. • https://www.exploit-db.com/exploits/30130 http://docs.info.apple.com/article.html?artnum=307562 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://osvdb.org/36855 http://rhn.redhat.com/errata/RHSA-2007-0889.html http://secunia.com/advisories/26871 http://secunia.com/advisories/26895 http://secunia.com/advisories/26930 http://secunia.com/advisories/26967 http://secunia.com/advisories/27351 http://secunia.com/advisories/27377 http://secunia&# • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 1%CPEs: 2EXPL: 3CVE-2007-3378
https://notcve.org/view.php?id=CVE-2007-3378
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess. Las funciones (1) session_save_path, (2) ini_set y (3) error_log en PHP versión 4.4.7 y versiones anteriores, y PHP versión 5 5.2.3 y versiones anteriores, cuando se invocan desde un archivo .htaccess, permiten a los atacantes remotos omitir las restricciones safe_mode y open_basedir y posiblemente ejecutar comandos arbitrarios, como se ha demostrado utilizando (a) php_value, (b) php_flag y (c) las directivas en .htaccess. • http://docs.info.apple.com/article.html?artnum=307562 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html http://seclists.org/fulldisclosure/2020/Sep/34 http://secunia.com/advisories/26642 http://secunia.com/advisories/26822 http://secunia.com/advisories/26838 http://secunia.com/advisories/27102 http://secunia.com/advisories/27377 http://secunia.com/advisories/27648 http://secunia. • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 1%CPEs: 1EXPL: 0CVE-2007-3007
https://notcve.org/view.php?id=CVE-2007-3007
PHP 5 before 5.2.3 does not enforce the open_basedir or safe_mode restriction in certain cases, which allows context-dependent attackers to determine the existence of arbitrary files by checking if the readfile function returns a string. NOTE: this issue might also involve the realpath function. PHP versión 5 anterior a 5.2.3 no aplica la restricción open_basedir o safe_mode en ciertos casos, lo que permite a los atacantes dependiendo del contexto determinar la presencia de archivos arbitrarios mediante la comprobación de si la función readfile devuelve una cadena. NOTA: este problema también puede involucrar la función realpath. • http://bugs.php.net/bug.php?id=41492 http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html http://osvdb.org/36084 http://secunia.com/advisories/25456 http://secunia.com/advisories/26048 http://secunia.com/advisories/26231 http://secunia.com/advisories/27102 http://secunia.com/advisories/27110 http://www.gentoo.org/security/en/glsa/glsa-200710-02.xml http://www.php.net/releases/5_2_3.php http://www.securityfocus.com/bid/24259 http:// • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 35%CPEs: 17EXPL: 1CVE-2007-2872 – PHP 5.1.6 - 'Chunk_Split()' Integer Overflow
https://notcve.org/view.php?id=CVE-2007-2872
Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments. Los múltiples desbordamientos de enteros en la función chunk_split en PHP versión 5 anterior a 5.2.3 y PHP versión 4 anterior a 4.4.8, permiten a los atacantes remotos causar una denegación de servicio (bloqueo) o ejecutar código arbitrario por medio de los argumentos (1) chunks, (2) srclen, y (3) chunklen. • https://www.exploit-db.com/exploits/30117 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01345501 http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00006.html http://osvdb.org/36083 http://rhn.redhat.com/errata/RHSA-2007-0889.html http://secunia.com/advisories/25456 http://secunia.com/advisories/25535 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 9.3EPSS: 3%CPEs: 73EXPL: 0CVE-2007-2844
https://notcve.org/view.php?id=CVE-2007-2844
PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access. PHP 4.x y 5.x anterior al 5.2.1, cuando corre bajo sistemas multi-hilo, no asegura la seguridad de los hilos para las llamadas a la función libc crypt utilizando esquemas de protección como el mutex, lo que provoca una condición de carrera que permite a atacantes remotos sobrescribir la memoria de programa interna y obtener acceso al sistema. • http://blog.php-security.org/archives/82-Suhosin-0.9.20-and-crypt-Thread-Safety-Vulnerability.html http://osvdb.org/36088 http://secunia.com/advisories/25434 http://www.securityfocus.com/bid/24109 https://exchange.xforce.ibmcloud.com/vulnerabilities/34601 •