In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
Max CVSS
8.8
EPSS Score
0.50%
Published
2020-04-01
Updated
2021-12-02
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
Max CVSS
9.8
EPSS Score
1.17%
Published
2020-02-19
Updated
2020-02-24
2 vulnerabilities found