PHP : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complex ity	Authen tication	Confiden tiality	Integrity	Availa bility
1	CVE-2012-2376	119	1	Exec Code Overflow	2012-05-21	2012-05-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
2	CVE-2012-2336	20		DoS	2012-05-11	2012-05-14	5.0	None	Remote	Low	Not required	None	None	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
3	CVE-2012-2335	264		Exec Code Bypass	2012-05-11	2012-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
4	CVE-2012-2329	119		DoS Overflow	2012-05-11	2012-05-22	5.0	None	Remote	Low	Not required	None	None	Partial
Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a denial of service (application crash) via a long string in the header of an HTTP request.
5	CVE-2012-2311	89		Exec Code Sql	2012-05-11	2012-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
6	CVE-2012-1823	20		Exec Code	2012-05-11	2012-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
7	CVE-2012-1172	20		DoS Dir. Trav.	2012-05-23	2012-05-24	5.8	None	Remote	Medium	Not required	None	Partial	Partial
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
8	CVE-2012-0831	89		Sql	2012-02-10	2012-02-24	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
9	CVE-2012-0830	399		Exec Code	2012-02-06	2012-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
10	CVE-2012-0789	399		DoS	2012-02-14	2012-02-14	5.0	None	Remote	Low	Not required	None	None	Partial
Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache.
11	CVE-2012-0788	20		DoS	2012-02-14	2012-02-14	5.0	None	Remote	Low	Not required	None	None	Partial
The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server.
12	CVE-2012-0781	399	1	DoS	2012-01-18	2012-01-19	5.0	None	Remote	Low	Not required	None	None	Partial
The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
13	CVE-2012-0057	264			2012-02-01	2012-02-16	6.4	None	Remote	Low	Not required	Partial	Partial	None
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.
14	CVE-2011-4885	20	2	DoS	2011-12-29	2012-05-11	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
15	CVE-2011-4566	189		DoS Overflow	2011-11-28	2012-05-11	6.4	None	Remote	Low	Not required	Partial	None	Partial
Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708.
16	CVE-2011-4153	20	1	DoS	2012-01-18	2012-01-18	5.0	None	Remote	Low	Not required	None	None	Partial
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
17	CVE-2011-3379	94		Exec Code	2011-11-03	2012-02-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.
18	CVE-2011-3268	119		Overflow	2011-08-25	2012-02-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.
19	CVE-2011-3267	399		DoS	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors.
20	CVE-2011-3189	310		Bypass	2011-08-25	2012-02-03	4.3	None	Remote	Medium	Not required	Partial	None	None
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
21	CVE-2011-3182			DoS Overflow	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.
22	CVE-2011-2483	310			2011-08-25	2012-02-08	5.0	None	Remote	Low	Not required	Partial	None	None
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
23	CVE-2011-2202	264			2011-06-16	2012-02-03	6.4	None	Remote	Low	Not required	None	Partial	Partial
The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames in multipart/form-data POST requests, which allows remote attackers to conduct absolute path traversal attacks, and possibly create or overwrite arbitrary files, via a crafted upload request, related to a "file path injection vulnerability."
24	CVE-2011-1938	119	1	Exec Code Overflow	2011-05-31	2012-02-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
25	CVE-2011-1657	399		DoS	2011-08-25	2012-02-03	5.0	None	Remote	Low	Not required	None	None	Partial
The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow context-dependent attackers to cause a denial of service (application crash) via certain flags arguments, as demonstrated by (a) GLOB_ALTDIRFUNC and (b) GLOB_APPEND.
26	CVE-2011-1471	189		DoS	2011-03-19	2012-01-18	4.3	None	Remote	Medium	Not required	None	None	Partial
Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.
27	CVE-2011-1470	20		DoS	2011-03-19	2011-10-20	4.3	None	Remote	Medium	Not required	None	None	Partial
The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function.
28	CVE-2011-1469			DoS	2011-03-19	2012-01-18	4.3	None	Remote	Medium	Not required	None	None	Partial
Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.
29	CVE-2011-1468	399		DoS	2011-03-19	2012-01-18	4.3	None	Remote	Medium	Not required	None	None	Partial
Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.
30	CVE-2011-1467			DoS	2011-03-19	2011-10-20	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409.
31	CVE-2011-1466	189		DoS Overflow	2011-03-19	2012-01-18	5.0	None	Remote	Low	Not required	None	None	Partial
Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.
32	CVE-2011-1464	119		DoS Overflow	2011-03-19	2011-04-08	4.3	None	Remote	Medium	Not required	None	None	Partial
Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument.
33	CVE-2011-1153	134		DoS Exec Code Mem. Corr. +Info	2011-03-16	2011-10-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
34	CVE-2011-1148	399		DoS Mem. Corr.	2011-03-18	2012-02-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
35	CVE-2011-1144	59			2011-03-02	2011-03-10	3.3	None	Local	Medium	Not required	None	Partial	Partial
The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.
36	CVE-2011-1092	189	1	DoS Overflow	2011-03-15	2011-10-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.
37	CVE-2011-1072	59			2011-03-02	2012-01-18	3.3	None	Local	Medium	Not required	None	Partial	Partial
The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519.
38	CVE-2011-0755	189		Overflow	2011-02-02	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mt_getrandmax.
39	CVE-2011-0754	59			2011-02-02	2011-07-18	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack of a FILE_ATTRIBUTE_REPARSE_POINT check.
40	CVE-2011-0753	362		DoS Mem. Corr.	2011-02-02	2011-07-18	4.3	None	Remote	Medium	Not required	None	None	Partial
Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.
41	CVE-2011-0752	20		Bypass	2011-02-02	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
42	CVE-2011-0708	119	1	DoS Overflow	2011-03-19	2012-01-18	4.3	None	Remote	Medium	Not required	None	None	Partial
exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
43	CVE-2011-0441	59			2011-03-29	2011-04-20	6.3	None	Local	Medium	Not required	None	Complete	Complete
The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.
44	CVE-2011-0421		1	DoS	2011-03-19	2011-10-27	4.3	None	Remote	Medium	Not required	None	None	Partial
The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.
45	CVE-2011-0420		1	DoS	2011-02-18	2011-10-20	5.0	None	Remote	Low	Not required	None	None	Partial
The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service (crash) via an invalid size argument, which triggers a NULL pointer dereference.
46	CVE-2010-4700	89		Sql	2011-01-18	2011-07-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The set_magic_quotes_runtime function in PHP 5.3.2 and 5.3.3, when the MySQLi extension is used, does not properly interact with use of the mysqli_fetch_assoc function, which might make it easier for context-dependent attackers to conduct SQL injection attacks via crafted input that had been properly handled in earlier PHP versions.
47	CVE-2010-4699	189		Bypass	2011-01-18	2011-07-18	5.0	None	Remote	Low	Not required	None	Partial	None
The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ks_c_5601-1987 character set.
48	CVE-2010-4698	119		DoS Overflow	2011-01-18	2011-08-01	5.0	None	Remote	Low	Not required	None	None	Partial
Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.
49	CVE-2010-4697	399		DoS Mem. Corr.	2011-01-18	2011-07-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and __unset methods on objects accessed by a reference.
50	CVE-2010-4645	189		DoS	2011-01-10	2011-10-20	5.0	None	Remote	Low	Not required	None	None	Partial
strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly handled in x87 FPU registers, as demonstrated using 2.2250738585072011e-308.

Total number of vulnerabilities : 349 Page : 1 (This Page)2 3 4 5 6 7