PHP

CVEs (751)

• CVE-2011-0708Mar 20, 2011
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.

• CVE-2011-0421Mar 20, 2011
  PHP

  PHP
  risk 0.04cvss —epss 0.14

  The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP…

• CVE-2011-1092Mar 15, 2011
  PHP

  PHP
  risk 0.04cvss —epss 0.18

  Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.

• CVE-2011-0420Feb 19, 2011
  PHP

  PHP
  risk 0.04cvss —epss 0.14

  The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows context-dependent attackers to cause a denial of service (crash) via an invalid size argument, which triggers a NULL pointer dereference.

• CVE-2010-4645Jan 11, 2011
  PHP

  PHP
  risk 0.04cvss —epss 0.15

  strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other products, allows context-dependent attackers to cause a denial of service (infinite loop) via a certain floating-point value in scientific notation, which is not properly…

• CVE-2010-3870Nov 12, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted…

• CVE-2010-4156Nov 10, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.13

  The mb_strcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).

• CVE-2010-3709Nov 9, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.13

  The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.

• CVE-2010-2094May 27, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.13

  Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1)…

• CVE-2010-1130Mar 26, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument…

• CVE-2010-1128Mar 26, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  The Linear Congruential Generator (LCG) in PHP before 5.2.13 does not provide the expected entropy, which makes it easier for context-dependent attackers to guess values that were intended to be unpredictable, as demonstrated by session cookies generated by using the uniqid…

• CVE-2010-0397Mar 16, 2010
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument to the xmlrpc_decode_request function, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) and…

• CVE-2009-4142Dec 21, 2009
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences, (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks by placing a crafted byte…

• CVE-2009-2626Dec 1, 2009
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the ini_set function to declare a variable, then using the…

• CVE-2009-4018Nov 29, 2009
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_env_vars and (2) safe_mode_protected_env_vars directives, which allows context-dependent attackers to execute programs with an arbitrary…

• CVE-2009-4017Nov 24, 2009
  PHP

  PHP
  risk 0.04cvss —epss 0.12

  PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service (resource exhaustion), and makes it easier for remote attackers to…

• CVE-2008-5498Dec 26, 2008
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument (aka the bgd_color or clrBack argument) for an indexed image.

• CVE-2008-5625Dec 17, 2008
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  PHP 5 before 5.2.7 does not enforce the error_log safe_mode restrictions when safe_mode is enabled through a php_admin_flag setting in httpd.conf, which allows context-dependent attackers to write to arbitrary files by placing a "php_value error_log" entry in a .htaccess file.

• CVE-2008-2666Jun 20, 2008
  PHP

  PHP
  risk 0.04cvss —epss 0.14

  Multiple directory traversal vulnerabilities in PHP 5.2.6 and earlier allow context-dependent attackers to bypass safe_mode restrictions by creating a subdirectory named http: and then placing ../ (dot dot slash) sequences in an http URL argument to the (1) chdir or (2) ftok…

• CVE-2007-3997Sep 4, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.14

  The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.