PHP » PHP : Security Vulnerabilities (Memory Corruption)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-21704	119		DoS Overflow Mem. Corr.	2021-10-04	2021-11-03	4.3	None	Remote	Medium	Not required	None	None	Partial
In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid response data that is not parsed correctly by the driver. This can result in crashes, denial of service or potentially memory corruption.
2	CVE-2020-7065	787		Exec Code Mem. Corr.	2020-04-01	2021-12-02	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mb_strtolower() function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution.
3	CVE-2017-9228	787		Mem. Corr.	2017-05-24	2018-05-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state transition. An incorrect state transition in parse_char_class() could create an execution path that leaves a critical local variable uninitialized until it's used as an index, resulting in an out-of-bounds write memory corruption.
4	CVE-2017-9226	787		Mem. Corr.	2017-05-24	2018-10-31	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled correctly in fetch_token() and fetch_token_in_cc(). A malformed regular expression containing an octal number in the form of '\700' would produce an invalid code point value larger than 0xff in next_state_val(), resulting in an out-of-bounds write memory corruption.
5	CVE-2016-10160	119		DoS Exec Code Overflow Mem. Corr.	2017-01-24	2018-05-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
6	CVE-2016-9935	125		DoS Mem. Corr.	2017-01-04	2018-05-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.
7	CVE-2016-7411	119		DoS Overflow Mem. Corr.	2016-09-17	2017-07-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.
8	CVE-2016-6291	119		DoS Overflow Mem. Corr. +Info	2016-07-25	2018-01-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.
9	CVE-2016-4342	119		DoS Overflow Mem. Corr.	2016-05-22	2018-10-30	8.3	None	Remote	Medium	Not required	Partial	Partial	Complete
ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive.
10	CVE-2016-3141	119		DoS Overflow Mem. Corr.	2016-03-31	2018-01-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.
11	CVE-2015-8878	119		DoS Overflow Mem. Corr.	2016-05-22	2019-02-14	7.1	None	Remote	Medium	Not required	None	None	Complete
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
12	CVE-2015-4021	189		DoS Mem. Corr.	2015-06-09	2019-04-22	5.0	None	Remote	Low	Not required	None	None	Partial
The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
13	CVE-2014-9426	17		DoS Mem. Corr.	2014-12-31	2015-03-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
DISPUTED The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which allows remote attackers to cause a denial of service (memory corruption or application crash) or possibly have unspecified other impact via unknown vectors. NOTE: this is disputed by the vendor because the standard erealloc behavior makes the free operation unreachable.
14	CVE-2014-3670	119		DoS Exec Code Overflow Mem. Corr.	2014-10-29	2016-10-18	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted JPEG image with TIFF thumbnail data that is improperly handled by the exif_thumbnail function.
15	CVE-2013-6420	119		DoS Exec Code Overflow Mem. Corr.	2013-12-17	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate that is not properly handled by the openssl_x509_parse function.
16	CVE-2013-4113	119		DoS Overflow Mem. Corr.	2013-07-13	2014-03-06	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted document that is processed by the xml_parse_into_struct function.
17	CVE-2011-1153	134		DoS Exec Code Mem. Corr. +Info	2011-03-16	2017-08-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
18	CVE-2011-1148	399		DoS Mem. Corr.	2011-03-18	2018-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
19	CVE-2011-0753	362		DoS Mem. Corr.	2011-02-02	2018-10-30	4.3	None	Remote	Medium	Not required	None	None	Partial
Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might allow context-dependent attackers to cause a denial of service (memory corruption) via a large number of concurrent signals.
20	CVE-2010-4697	399		DoS Mem. Corr.	2011-01-18	2018-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and __unset methods on objects accessed by a reference.
21	CVE-2010-4150	399		DoS Exec Code Mem. Corr.	2010-12-07	2017-09-19	5.0	None	Remote	Low	Not required	None	None	Partial
Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
22	CVE-2010-2484	200		Mem. Corr. +Info	2010-08-20	2016-08-23	5.0	None	Remote	Low	Not required	Partial	None	None
The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.
23	CVE-2010-2191	119		Overflow Mem. Corr. +Info	2010-06-08	2017-08-17	6.4	None	Remote	Low	Not required	Partial	Partial	None
The (1) parse_str, (2) preg_match, (3) unpack, and (4) pack functions; the (5) ZEND_FETCH_RW, (6) ZEND_CONCAT, and (7) ZEND_ASSIGN_CONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.
24	CVE-2010-1866	189		DoS Overflow Mem. Corr. Bypass	2010-05-07	2010-09-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an integer overflow in the chunk size decoder.
25	CVE-2010-1860	200		Mem. Corr. +Info	2010-05-07	2016-08-23	5.0	None	Remote	Low	Not required	Partial	None	None
The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.
26	CVE-2007-3806	20	1	DoS Exec Code Mem. Corr.	2007-07-17	2017-09-29	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
27	CVE-2007-1484			Exec Code Mem. Corr. Bypass	2007-03-16	2018-10-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The array_user_key_compare function in PHP 4.4.6 and earlier, and 5.x up to 5.2.1, makes erroneous calls to zval_dtor, which triggers memory corruption and allows local users to bypass safe_mode and execute arbitrary code via a certain unset operation after array_user_key_compare has been called.

Total number of vulnerabilities : 27 Page : 1 (This Page)