Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function.
An array index error, leading to invalid free flaw was found in the way XML extension of PHP, a scripting language for creating dynamic web sites, used to convert certain XML files into PHP language internal structures. Remote attacker could provide a specially-crafted XML file, that when opened in an PHP application would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application.
References: http://php.net/archive/2013.php#id2013-07-11-1 http://www.php.net/ChangeLog-5.php#5.3.27
Upstream bug report: https://bugs.php.net/bug.php?id=65236
Relevant patch: https://bugs.php.net/patch-display.php?bugid=65236&patch=bug65236.diff&revision=latest http://git.php.net/?p=php-src.git;a=commitdiff;h=7d163e8a0880ae8af2dd869071393e5dc07ef271
The sapiheaderop function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the openbasedir protection mechanism via unspecified vectors.
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function.
Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of set, get, isset, and unset methods on objects accessed by a reference.
The iconvmimedecodeheaders function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ksc5601-1987 character set.
Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.
Double free vulnerability in the imapdoopen function in the IMAP extension (ext/imap/phpimap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
The mbstrcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).
The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
fopenwrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass openbasedir restrictions via vectors related to the length of a filename.
Stack consumption vulnerability in the filtervar function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTERVALIDATEEMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the pharstreamflush function, leading to errors in the phpstreamwrapperlogerror function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PSUNDEFMARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.
The phpmysqlndreaderrorfromline function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.
Stack-based buffer overflow in the phpmysqlndauthwrite function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument to the (a) mysqlconnect or (b) mysqliconnect function.
mysqlndwireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the phpmysqlndokread function; or (2) trigger a heap-based buffer overflow via a modified length value, which is not properly handled by the phpmysqlndrsetheaderread function.
The (1) trim, (2) ltrim, (3) rtrim, and (4) substrreplace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
The (1) parsestr, (2) pregmatch, (3) unpack, and (4) pack functions; the (5) ZENDFETCHRW, (6) ZENDCONCAT, and (7) ZENDASSIGNCONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.
The (1) striptags, (2) setcookie, (3) strtok, (4) wordwrap, (5) strwordcount, and (6) strpad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.
The (1) htmlentities, (2) htmlspecialchars, (3) strgetcsv, (4) httpbuildquery, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
The (1) iconvmimedecode, (2) iconvsubstr, and (3) iconvmimeencode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2094 to the following vulnerability:
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) pharstreamflush, (2) pharwrapperunlink, (3) pharparseurl, or (4) pharwrapperopenurl functions in ext/phar/stream.c; and the (5) pharwrapperopendir function in ext/phar/dirstream.c, which triggers errors in the phpstreamwrapperlogerror function.
References: [1] http://php-security.org/2010/05/14/mops-2010-024-php-pharstreamflush-format-string-vulnerability/index.html [2] http://php-security.org/2010/05/14/mops-2010-025-php-pharwrapperopendir-format-string-vulnerability/index.html [3] http://php-security.org/2010/05/14/mops-2010-026-php-pharwrapperunlink-format-string-vulnerability/index.html [4] http://php-security.org/2010/05/14/mops-2010-027-php-pharparseurl-format-string-vulnerabilities/index.html [5] http://php-security.org/2010/05/14/mops-2010-028-php-pharwrapperopenurl-format-string-vulnerabilities/index.html
Public PoC (from [1]):
$ php -r "fopen('phar:///usr/bin/phar.phar/%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');"
Credit: All flaws discovered by Stefan Esser.
The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZENDBWXOR opcode (shiftleftfunction), (2) ZENDSL opcode (bitwisexorfunction), or (3) ZENDSR opcode (shiftrightfunction), related to the converttolongbase function.
The pregquote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.
Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.
The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's sleep function to interrupt an internal call to the shmputvar function, which triggers access of a freed resource.