CVSS: 10.0EPSS: 82%CPEs: 3EXPL: 2CVE-2007-1399 – PHP 5.2.0 / PHP with PECL ZIP 1.8.3 - 'zip://' URL Wrapper Buffer Overflow
https://notcve.org/view.php?id=CVE-2007-1399
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback. Desbordamiento de búfer basado en pila en el envoltorio (wrapper) de URL zip:// en PECL ZIP 1.8.3 y anteriores, como ha sido incluido en PHP 5.2.0 y 5.2.1, permite a atacantes remotos ejecutar código de su elección mediante una URL zip:// larga, como ha sido demostrado accediendo activamente a la URL desde un intérprete PHP remoto mediante una subida avatar o notificación de que el blog ha sido enlazado (blog pingback). • https://www.exploit-db.com/exploits/3440 http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html http://secunia.com/advisories/24471 http://secunia.com/advisories/24514 http://secunia.com/advisories/25938 http://www.debian.org/security/2007/dsa-1330 http://www.osvdb.org/32782 http://www.php-security.org/MOPB/MOPB-16-2007.html http://www.securityfocus.com/bid/22883 http://www.vupen.com/english/advisories/2007/0898 https://exchange.xforce.ibmcloud. •
CVSS: 7.5EPSS: 6%CPEs: 73EXPL: 4CVE-2007-1376 – PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure
https://notcve.org/view.php?id=CVE-2007-1376
The shmop functions in PHP before 4.4.5, and before 5.2.1 in the 5.x series, do not verify that their arguments correspond to a shmop resource, which allows context-dependent attackers to read and write arbitrary memory locations via arguments associated with an inappropriate resource, as demonstrated by a GD Image resource. Las funciones shomp en PHP anterior a 4.4.5, y anterior a 5.2.1 en las series 5.x, no verifica que sus argumentos corresponden a un recurso shmop, lo caul permite a atacantes dependientes del contexto leer y escribir localizaciones de memoria de su elección a través de argumentos asociados con un recurso inapropiado, como se demostró con un recurso de imagen GD. • https://www.exploit-db.com/exploits/3427 https://www.exploit-db.com/exploits/3426 http://secunia.com/advisories/24606 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http://secunia.com/advisories/25062 http://security.gentoo.org/glsa/glsa-200703-21.xml http://www.debian.org/security/2007/dsa-1283 http://www.novell.com/linux/security/advisories/2007_32_php.html http://www.osvdb.org/32781 http://www.php-security.org/MOPB/MOPB-15-2007.ht •
CVSS: 5.0EPSS: 1%CPEs: 72EXPL: 2CVE-2007-1380 – PHP < 4.4.5/5.2.1 - PHP_binary Session Deserialization Information Leak
https://notcve.org/view.php?id=CVE-2007-1380
The php_binary serialization handler in the session extension in PHP before 4.4.5, and 5.x before 5.2.1, allows context-dependent attackers to obtain sensitive information (memory contents) via a serialized variable entry with a large length value, which triggers a buffer over-read. El manejador de serialización php_binary en la extensión de sesión de PHP anterior a 4.4.5, y 5.x anterior a 5.2.1, permite a atacantes dependientes del contexto obtener información sensible (contenidos de memoria) a través de entradas de variables serializables con un valor length, lo cual dispara un desbordamiento de búfer de lectura. • https://www.exploit-db.com/exploits/3413 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056506 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01086137 http://lists.suse.com/archive/suse-security-announce/2007-Mar/0003.html http://secunia.com/advisories/24514 http://secunia.com/advisories/24606 http://secunia.com/advisories/25025 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http: •
CVSS: 5.0EPSS: 3%CPEs: 1EXPL: 2CVE-2007-1375 – PHP 5.2.1 - 'substr_compare()' Information Leak
https://notcve.org/view.php?id=CVE-2007-1375
Integer overflow in the substr_compare function in PHP 5.2.1 and earlier allows context-dependent attackers to read sensitive memory via a large value in the length argument, a different vulnerability than CVE-2006-1991. Desbordamiento de enteros en la función substr_compare en PHP 5.2.1 y anteriores permite a atacantes dependientes del contexto leer memoria sensible a través de un valor en el argumento length, un vulnerabilidad diferente que CVE-2006-1991. • https://www.exploit-db.com/exploits/3424 http://secunia.com/advisories/24606 http://secunia.com/advisories/25056 http://secunia.com/advisories/25057 http://secunia.com/advisories/25062 http://secunia.com/advisories/26895 http://security.gentoo.org/glsa/glsa-200703-21.xml http://us2.php.net/releases/5_2_2.php http://www.debian.org/security/2007/dsa-1283 http://www.mandriva.com/security/advisories?name=MDKSA-2007:187 http://www.novell.com/linux/security/advisories •
CVSS: 4.3EPSS: 1%CPEs: 4EXPL: 2CVE-2007-1287 – PHP 4.4.3 < 4.4.6 - 'PHPinfo()' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1287
A regression error in the phpinfo function in PHP 4.4.3 to 4.4.6, and PHP 6.0 in CVS, allows remote attackers to conduct cross-site scripting (XSS) attacks via GET, POST, or COOKIE array values, which are not escaped in the phpinfo output, as originally fixed for CVE-2005-3388. Un error de regresión en la función phpinfo de PHP 4.4.3 a 4.4.6, y PHP 6.0 en CVS, permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) mediante valores en los vectores GET, POST, o COOKIE, los cuales no son "escapados" en la salida de phpinfo, como fue originalmente apuntado en CVE-2005-3388. • https://www.exploit-db.com/exploits/3405 http://docs.info.apple.com/article.html?artnum=306172 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://secunia.com/advisories/26235 http://us2.php.net/releases/4_4_7.php http://www.osvdb.org/32774 http://www.php-security.org/MOPB/MOPB-08-2007.html http://www.securityfocus.com/bid/25159 http://www.vupen.com/english/advisories/2007/2732 •