In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce. 
Source: PHP Group
Max CVSS
4.3
EPSS Score
0.05%
Published
2023-07-22
Updated
2023-08-01
In PHP versions 7.2.x below 7.2.33, 7.3.x below 7.3.21 and 7.4.x below 7.4.9, while processing PHAR files using phar extension, phar_parse_zipfile could be tricked into accessing freed memory, which could lead to a crash or information disclosure.
Source: PHP Group
Max CVSS
4.8
EPSS Score
0.06%
Published
2020-09-09
Updated
2022-07-01
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environment) to obtain sensitive information from the process memory of a second user's PHP applications by running gcore on the PID of the PHP-FPM worker process.
Source: MITRE
Max CVSS
4.7
EPSS Score
0.07%
Published
2018-04-29
Updated
2019-08-19
Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.
Source: MITRE
Max CVSS
4.3
EPSS Score
1.34%
Published
2016-05-22
Updated
2018-01-05
Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments.
Source: MITRE
Max CVSS
4.6
EPSS Score
0.29%
Published
2014-07-10
Updated
2023-01-19
Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments.
Source: MITRE
Max CVSS
4.6
EPSS Score
0.25%
Published
2014-07-10
Updated
2017-01-07
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
7.96%
Published
2014-08-23
Updated
2018-01-05
The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
1.57%
Published
2014-07-09
Updated
2022-10-28
The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.69%
Published
2014-07-09
Updated
2022-10-28
The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.69%
Published
2014-07-09
Updated
2022-10-28
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.
Source: MITRE
Max CVSS
4.3
EPSS Score
0.98%
Published
2014-03-21
Updated
2022-09-28
softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
Source: Debian GNU/Linux
Max CVSS
4.3
EPSS Score
95.86%
Published
2014-03-14
Updated
2022-10-28
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.85%
Published
2014-07-09
Updated
2022-09-28
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_sdl function in ext/soap/php_sdl.c.
Source: Red Hat, Inc.
Max CVSS
4.6
EPSS Score
0.05%
Published
2015-03-30
Updated
2016-11-30
The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via an MP3 file that triggers incorrect MIME type detection during access to an finfo object.
Source: MITRE
Max CVSS
4.3
EPSS Score
0.22%
Published
2013-06-21
Updated
2013-06-24
The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
2.92%
Published
2013-08-18
Updated
2016-11-28
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.16%
Published
2013-09-16
Updated
2023-02-13
The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.15%
Published
2012-09-07
Updated
2023-02-13
The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
0.21%
Published
2012-07-05
Updated
2024-03-14
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
Source: Red Hat, Inc.
Max CVSS
4.3
EPSS Score
1.35%
Published
2011-08-25
Updated
2017-08-29
Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.
Source: MITRE
Max CVSS
4.3
EPSS Score
3.03%
Published
2011-03-20
Updated
2023-01-19
The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function.
Source: MITRE
Max CVSS
4.3
EPSS Score
1.91%
Published
2011-03-20
Updated
2018-10-30
Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.
Source: MITRE
Max CVSS
4.3
EPSS Score
1.53%
Published
2011-03-20
Updated
2018-10-30
Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.
Source: MITRE
Max CVSS
4.3
EPSS Score
15.02%
Published
2011-03-20
Updated
2018-10-30
Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument.
Source: MITRE
Max CVSS
4.3
EPSS Score
2.23%
Published
2011-03-20
Updated
2018-10-30
57 vulnerabilities found
1 2 3
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!