CVSS: 7.5EPSS: 8%CPEs: 73EXPL: 4CVE-2007-1376 – PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure
https://notcve.org/view.php?id=CVE-2007-1376
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate resource, as demonstrated by a GD Image resource. Las funciones shomp en PHP anterior a 4.4.5, y anterior a 5.2.1 en las series 5.x, no verifica que sus argumentos corresponden a un recurso shmop, lo caul permite a atacantes dependientes del contexto leer y escribir localizaciones de memoria de su elección a través de argumentos asociados con un recurso inapropiado, como se demostró con un recurso de imagen GD. • https://www.exploit-db.com/exploits/3427 https://www.exploit-db.com/exploits/3426 http://secunia.com/advisories/24606 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http://secunia.com/advisories/25062 http://security.gentoo.org/glsa/glsa-200703-21.xml http://www.debian.org/security/2007/dsa-1283 http://www.novell.com/linux/security/advisories/2007_32_php.html http://www.osvdb.org/32781 http://www.php-security.org/MOPB/MOPB-15-2007.ht •
CVSS: 5.0EPSS: 1%CPEs: 72EXPL: 2CVE-2007-1380 – PHP < 4.4.5/5.2.1 - PHP_binary Session Deserialization Information Leak
https://notcve.org/view.php?id=CVE-2007-1380
The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read. El manejador de serialización php_binary en la extensión de sesión de PHP anterior a 4.4.5, y 5.x anterior a 5.2.1, permite a atacantes dependientes del contexto obtener información sensible (contenidos de memoria) a través de entradas de variables serializables con un valor length, lo cual dispara un desbordamiento de búfer de lectura. • https://www.exploit-db.com/exploits/3413 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html http://secunia.com/advisories/24514 http://secunia.com/advisories/24606 http://secunia.com/advisories/25025 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http: •
CVSS: 6.8EPSS: 16%CPEs: 1EXPL: 4CVE-2007-1286 – PHP 4.4.4 - 'Unserialize()' ZVAL Reference Counter Overflow (PoC)
https://notcve.org/view.php?id=CVE-2007-1286
Integer overflow in PHP 4.4.4 and earlier allows remote context-dependent attackers to execute arbitrary code via a long string to the unserialize function, which triggers the overflow in the ZVAL reference counter. Desbordamiento de entero en PHP 4.4.4 y anteriores permiten a atacantes dependientes de contexto ejecutar código de su elección mediante el paso de una cadena larga a la función unserialize, lo cual provoca el desbordamiento en el contador de referencias ZVAL. • https://www.exploit-db.com/exploits/3396 https://www.exploit-db.com/exploits/16310 https://www.exploit-db.com/exploits/9939 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 http://rhn.redhat.com/errata/RHSA-2007-0154.html http://rhn.redhat.com/errata/RHSA-2007-0155.html http://rhn.redhat.com/errata/RHSA-2007-0163.html http://secunia& •
CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 2CVE-2007-1287 – PHP 4.4.3 < 4.4.6 - 'PHPinfo()' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1287
A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388. Un error de regresión en la función phpinfo de PHP 4.4.3 a 4.4.6, y PHP 6.0 en CVS, permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) mediante valores en los vectores GET, POST, o COOKIE, los cuales no son "escapados" en la salida de phpinfo, como fue originalmente apuntado en CVE-2005-3388. • https://www.exploit-db.com/exploits/3405 http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/26235 http://us2.php.net/releases/4_4_7.php http://www.osvdb.org/32774 http://www.php-security.org/MOPB/MOPB-08-2007.html http://www.securityfocus.com/bid/25159 http://www.vupen.com/english/advisories/2007/2732 •
CVSS: 7.5EPSS: 15%CPEs: 15EXPL: 3CVE-2007-1285 – PHP 3/4/5 - ZendEngine Variable Destruction Remote Denial of Service
https://notcve.org/view.php?id=CVE-2007-1285
The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays, which trigger deep recursion in the variable destruction routines. El motor Zend en PHP versión 4.x anterior a 4.4.7, y versión 5.x anterior a 5.2.2, permite que los atacantes remotos causen una denegación de servicio (agotamiento de pila y bloqueo de PHP) por medio de matrices profundamente anidadas, que desencadenan una profunda recursión en la variable de rutinas de destrucción. • https://www.exploit-db.com/exploits/29692 http://lists.opensuse.org/opensuse-security-announce/2007-07/msg00006.html http://rhn.redhat.com/errata/RHSA-2007-0154.html http://rhn.redhat.com/errata/RHSA-2007-0155.html http://rhn.redhat.com/errata/RHSA-2007-0163.html http://secunia.com/advisories/24909 http://secunia.com/advisories/24910 http://secunia.com/advisories/24924 http://secunia.com/advisories/24941 http://secunia.com/advisories/24945 http://secunia.com/advisories&#x • CWE-674: Uncontrolled Recursion •