rpm package
suse/php7&distro=SUSE Linux Enterprise Software Development Kit 12 SP3
pkg:rpm/suse/php7&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3
Vulnerabilities (35)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-11040 | — | < 7.0.7-50.80.2 | 7.0.7-50.80.2 | Jun 18, 2019 | When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may | ||
| CVE-2019-11039 | — | < 7.0.7-50.80.2 | 7.0.7-50.80.2 | Jun 18, 2019 | Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash. | ||
| CVE-2019-11036 | — | < 7.0.7-50.75.1 | 7.0.7-50.75.1 | May 3, 2019 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash. | ||
| CVE-2019-11035 | — | < 7.0.7-50.75.1 | 7.0.7-50.75.1 | Apr 18, 2019 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash. | ||
| CVE-2019-11034 | — | < 7.0.7-50.75.1 | 7.0.7-50.75.1 | Apr 18, 2019 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash. | ||
| CVE-2019-6978 | — | < 7.0.7-50.63.1 | 7.0.7-50.63.1 | Jan 28, 2019 | The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected. | ||
| CVE-2019-6977 | — | < 7.0.7-50.63.1 | 7.0.7-50.63.1 | Jan 27, 2019 | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker | ||
| CVE-2018-19935 | — | < 7.0.7-50.63.1 | 7.0.7-50.63.1 | Dec 7, 2018 | ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function. | ||
| CVE-2018-19518 | — | < 7.0.7-50.56.2 | 7.0.7-50.56.2 | Nov 25, 2018 | University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, wh | ||
| CVE-2018-17082 | — | < 7.0.7-50.52.1 | 7.0.7-50.52.1 | Sep 16, 2018 | The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache | ||
| CVE-2018-14851 | — | < 7.0.7-50.44.1 | 7.0.7-50.44.1 | Aug 2, 2018 | exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file. | ||
| CVE-2017-9120 | — | < 7.0.7-50.44.1 | 7.0.7-50.44.1 | Aug 2, 2018 | PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string. | ||
| CVE-2017-9118 | — | < 7.0.7-50.49.1 | 7.0.7-50.49.1 | Aug 2, 2018 | PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. | ||
| CVE-2018-12882 | — | < 7.0.7-50.41.1 | 7.0.7-50.41.1 | Jun 26, 2018 | exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function. | ||
| CVE-2018-10548 | — | < 7.0.7-50.38.2 | 7.0.7-50.38.2 | Apr 29, 2018 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn retur | ||
| CVE-2018-10547 | — | < 7.0.7-50.38.2 | 7.0.7-50.38.2 | Apr 29, 2018 | An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists bec | ||
| CVE-2018-10546 | — | < 7.0.7-50.38.2 | 7.0.7-50.38.2 | Apr 29, 2018 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences. | ||
| CVE-2018-10545 | — | < 7.0.7-50.38.2 | 7.0.7-50.38.2 | Apr 29, 2018 | An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environmen | ||
| CVE-2018-7584 | — | < 7.0.7-50.32.1 | 7.0.7-50.32.1 | Mar 1, 2018 | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copyin | ||
| CVE-2018-5712 | — | < 7.0.7-50.26.1 | 7.0.7-50.26.1 | Jan 16, 2018 | An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. |
- CVE-2019-11040Jun 18, 2019affected < 7.0.7-50.80.2fixed 7.0.7-50.80.2
When PHP EXIF extension is parsing EXIF information from an image, e.g. via exif_read_data() function, in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 it is possible to supply it with data what will cause it to read past the allocated buffer. This may
- CVE-2019-11039Jun 18, 2019affected < 7.0.7-50.80.2fixed 7.0.7-50.80.2
Function iconv_mime_decode_headers() in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6 may perform out-of-buffer read due to integer overflow when parsing MIME headers. This may lead to information disclosure or crash.
- CVE-2019-11036May 3, 2019affected < 7.0.7-50.75.1fixed 7.0.7-50.75.1
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
- CVE-2019-11035Apr 18, 2019affected < 7.0.7-50.75.1fixed 7.0.7-50.75.1
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_iif_add_value function. This may lead to information disclosure or crash.
- CVE-2019-11034Apr 18, 2019affected < 7.0.7-50.75.1fixed 7.0.7-50.75.1
When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exif_process_IFD_TAG function. This may lead to information disclosure or crash.
- CVE-2019-6978Jan 28, 2019affected < 7.0.7-50.63.1fixed 7.0.7-50.63.1
The GD Graphics Library (aka LibGD) 2.2.5 has a double free in the gdImage*Ptr() functions in gd_gif_out.c, gd_jpeg.c, and gd_wbmp.c. NOTE: PHP is unaffected.
- CVE-2019-6977Jan 27, 2019affected < 7.0.7-50.63.1fixed 7.0.7-50.63.1
gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker
- CVE-2018-19935Dec 7, 2018affected < 7.0.7-50.63.1fixed 7.0.7-50.63.1
ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty string in the message argument to the imap_mail function.
- CVE-2018-19518Nov 25, 2018affected < 7.0.7-50.56.2fixed 7.0.7-50.56.2
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, wh
- CVE-2018-17082Sep 16, 2018affected < 7.0.7-50.52.1fixed 7.0.7-50.52.1
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache
- CVE-2018-14851Aug 2, 2018affected < 7.0.7-50.44.1fixed 7.0.7-50.44.1
exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.
- CVE-2017-9120Aug 2, 2018affected < 7.0.7-50.44.1fixed 7.0.7-50.44.1
PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string.
- CVE-2017-9118Aug 2, 2018affected < 7.0.7-50.49.1fixed 7.0.7-50.49.1
PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call.
- CVE-2018-12882Jun 26, 2018affected < 7.0.7-50.41.1fixed 7.0.7-50.41.1
exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.
- CVE-2018-10548Apr 29, 2018affected < 7.0.7-50.38.2fixed 7.0.7-50.38.2
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn retur
- CVE-2018-10547Apr 29, 2018affected < 7.0.7-50.38.2fixed 7.0.7-50.38.2
An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists bec
- CVE-2018-10546Apr 29, 2018affected < 7.0.7-50.38.2fixed 7.0.7-50.38.2
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. An infinite loop exists in ext/iconv/iconv.c because the iconv stream filter does not reject invalid multibyte sequences.
- CVE-2018-10545Apr 29, 2018affected < 7.0.7-50.38.2fixed 7.0.7-50.38.2
An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4. Dumpable FPM child processes allow bypassing opcache access controls because fpm_unix.c makes a PR_SET_DUMPABLE prctl call, allowing one user (in a multiuser environmen
- CVE-2018-7584Mar 1, 2018affected < 7.0.7-50.32.1fixed 7.0.7-50.32.1
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copyin
- CVE-2018-5712Jan 16, 2018affected < 7.0.7-50.26.1fixed 7.0.7-50.26.1
An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.
Page 1 of 2