PHP

CVEs (751)

• CVE-2007-4596Aug 30, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  The perl extension in PHP does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might only be a vulnerability in limited environments.

• CVE-2007-4586Aug 29, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Multiple buffer overflows in php_iisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iis_getservicestate…

• CVE-2007-4255Aug 8, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to the msql_connect function.

• CVE-2007-4033Jul 27, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.19

  Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll…

• CVE-2007-3806Jul 17, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.11

  The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to…

• CVE-2007-3799Jul 16, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the…

• CVE-2007-3294Jun 20, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Multiple buffer overflows in libtidy, as used in the Tidy extension for PHP 5.2.3 and possibly other products, allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the…

• CVE-2007-2872Jun 4, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.

• CVE-2007-0448May 24, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.

• CVE-2007-2369Apr 30, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Directory traversal vulnerability in picture.php in WebSPELL 4.01.02 and earlier, when PHP before 4.3.0 is used, allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.

• CVE-2007-1890Apr 6, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dependent attackers to execute arbitrary code via certain maxsize values, as demonstrated by 0xffffffff.

• CVE-2007-1001Apr 6, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allow context-dependent attackers to execute arbitrary code via Wireless Bitmap (WBMP) images with large width or…

• CVE-2007-1825Apr 2, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.10

  Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411, it appears that this issue might be subsumed by…

• CVE-2007-1777Mar 30, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.15

  Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contains an entry with a length value of 0xffffffff, which is incremented before use in an emalloc call, triggering a heap overflow.

• CVE-2007-1718Mar 28, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  CRLF injection vulnerability in the mail function in PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows remote attackers to inject arbitrary e-mail headers and possibly conduct spam attacks via a control character immediately following folding of the (1) Subject or (2) To…

• CVE-2007-1700Mar 27, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  The session extension in PHP 4 before 4.4.5, and PHP 5 before 5.2.1, calculates the reference count for the session variables without considering the internal pointer from the session globals, which allows context-dependent attackers to execute arbitrary code via a crafted…

• CVE-2007-1711Mar 27, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to…

• CVE-2007-1701Mar 27, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.09

  PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string…

• CVE-2007-1649Mar 24, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.07

  PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with S:, which does not properly track the number of input bytes being processed.

• CVE-2007-1581Mar 21, 2007
  PHP

  PHP
  risk 0.04cvss —epss 0.08

  The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it…