PHP

CVEs (751)

• CVE-2012-1823CriKEVMay 11, 2012
  PHP

  PHP
  risk 0.87cvss 9.8epss 1.00

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options…

• CVE-2019-11043HigKEVOct 28, 2019
  PHP

  PHP
  risk 0.79cvss 8.7epss 0.99

  In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code…

• CVE-2016-3078CriAug 7, 2016
  PHP

  PHP
  risk 0.71cvss 9.8epss 0.56

  Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2)…

• CVE-2015-6835CriMay 16, 2016
  PHP

  PHP
  risk 0.70cvss 9.8epss 0.37

  The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

• CVE-2015-6834CriMay 16, 2016
  PHP

  PHP
  risk 0.70cvss 9.8epss 0.47

  Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList…

• CVE-2016-3074CriApr 26, 2016
  Libgd

  Libgd
  risk 0.70cvss 9.8epss 0.37

  Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

• CVE-2016-4071CriMay 20, 2016
  PHP

  PHP
  risk 0.68cvss 9.8epss 0.19

  Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.

• CVE-2007-1399CriMar 10, 2007
  PHP

  PHP
  risk 0.68cvss 9.8epss 0.20

  Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via…

• CVE-2007-1383CriMar 10, 2007
  PHP

  PHP
  risk 0.68cvss 9.8epss 0.15

  Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.

• CVE-2011-1939CriNov 26, 2019
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.04

  SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.

• CVE-2016-7479CriJan 12, 2017
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.42

  In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

• CVE-2016-7480CriJan 11, 2017
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.42

  The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.

• CVE-2016-3141CriMar 31, 2016
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.36

  Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize…

• CVE-2010-1866CriMay 7, 2010
  PHP

  PHP
  risk 0.67cvss 9.8epss 0.07

  The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dependent attackers to cause a denial of service (crash) and possibly trigger memory corruption via a negative chunk size, which bypasses a signed comparison, related to an…

• CVE-2019-9021CriFeb 22, 2019
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.10

  An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when…

• CVE-2019-9020CriFeb 22, 2019
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.10

  An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in…

• CVE-2017-5340CriJan 11, 2017
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.17

  Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary…

• CVE-2016-7124CriSep 12, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.17

  ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or…

• CVE-2016-5771CriAug 7, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.15

  spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application…

• CVE-2016-3132CriAug 7, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.12

  Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.