CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 1CVE-2021-21708 – UAF due to php_filter_float() failing
https://notcve.org/view.php?id=CVE-2021-21708
In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits. En PHP versiones 7.4.x anteriores a 7.4.28, versiones 8.0.x anteriores a 8.0.16 y versiones 8.1.x anteriores a 8.1.3, cuando son usados funciones de filtrado con el filtro FILTER_VALIDATE_FLOAT y los límites mínimo/máximo, si el filtro falla, se presenta la posibilidad de que sea activado el uso de la memoria asignada después de liberarla, lo que puede resultar en un bloqueo, y potencialmente la sobreescritura de otros trozos de memoria y RCE. Este problema afecta a: el código que usa FILTER_VALIDATE_FLOAT con límites mín/máx. A flaw was found in PHP. • https://bugs.php.net/bug.php?id=81708 https://security.gentoo.org/glsa/202209-20 https://security.netapp.com/advisory/ntap-20220325-0004 https://access.redhat.com/security/cve/CVE-2021-21708 https://bugzilla.redhat.com/show_bug.cgi?id=2055879 • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2017-9118 – php: Out of bounds access in php_pcre.c:php_pcre_replace_impl()
https://notcve.org/view.php?id=CVE-2017-9118
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. PHP 7.1.5 tiene un acceso fuera de límites en php_pcre_replace_impl mediante una llamada preg_replace. • https://access.redhat.com/errata/RHSA-2019:2519 https://bugs.php.net/bug.php?id=74604 https://security.netapp.com/advisory/ntap-20181107-0003 https://access.redhat.com/security/cve/CVE-2017-9118 https://bugzilla.redhat.com/show_bug.cgi?id=1611890 • CWE-125: Out-of-bounds Read CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.3EPSS: 5%CPEs: 85EXPL: 0CVE-2006-3017
https://notcve.org/view.php?id=CVE-2006-3017
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations. • ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0166.html http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&r1=1.87.4.8.2.1&r2=1.87.4.8.2.2 http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?hideattic=0&view=log http://rhn.redhat.com/errata/RHSA-2006-0549.html http://secunia.com/advisories/19927 http://secunia.com/advisories/21031 http://secunia.com/advisories/21050 •