PHP

CVEs (730)

• CVE-2016-4543CriMay 22, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.12

  The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via…

• CVE-2016-2554CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.

• CVE-2015-4643CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.17

  Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this…

• CVE-2015-4603CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

• CVE-2015-4602CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type,…

• CVE-2015-4600CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1)…

• CVE-2015-4599CriMay 16, 2016
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data…

• CVE-2008-0599CriMay 5, 2008
  PHP

  PHP
  risk 0.65cvss 9.8epss 0.11

  The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.

• CVE-2014-3622CriFeb 19, 2020
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.03

  Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.

• CVE-2019-9641CriMar 9, 2019
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.09

  An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. There is an uninitialized read in exif_process_IFD_in_TIFF.

• CVE-2019-9025CriFeb 22, 2019
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.03

  An issue was discovered in PHP 7.3.x before 7.3.1. An invalid multibyte string supplied as an argument to the mb_split() function in ext/mbstring/php_mbregex.c can cause PHP to execute memcpy() with a negative argument, which could read and write past buffers allocated for the…

• CVE-2019-9023CriFeb 22, 2019
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.09

  An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in…

• CVE-2018-12882CriJun 26, 2018
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.07

  exif_read_from_impl in ext/exif/exif.c in PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) because it closes a stream that it is not responsible for closing. The vulnerable code is reachable through the PHP exif_read_data function.

• CVE-2017-12933CriAug 18, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.07

  The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of…

• CVE-2017-12932CriAug 18, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.07

  ext/standard/var_unserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this…

• CVE-2017-11362CriJul 17, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.03

  In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact…

• CVE-2016-4473CriJun 8, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.08

  /ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

• CVE-2017-9228CriMay 24, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write occurs in bitset_set_range() during regular expression compilation due to an uninitialized variable from an incorrect state…

• CVE-2017-9227CriMay 24, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.06

  An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A stack out-of-bounds read occurs in mbc_enc_len() during regular expression searching. Invalid handling of reg->dmin in forward_search_range() could…

• CVE-2017-9226CriMay 24, 2017
  PHP

  PHP
  risk 0.64cvss 9.8epss 0.08

  An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5. A heap out-of-bounds write or read occurs in next_state_val() during regular expression compilation. Octal numbers larger than 0xff are not handled…