An array index error, leading to invalid free flaw was found in the way XML extension of PHP, a scripting language for creating dynamic web sites, used to convert certain XML files into PHP language internal structures. Remote attacker could provide a specially-crafted XML file, that when opened in an PHP application would lead to that application crash or, potentially, arbitrary code execution with the privileges of the user running the application.

References: http://php.net/archive/2013.php#id2013-07-11-1 http://www.php.net/ChangeLog-5.php#5.3.27

Upstream bug report: https://bugs.php.net/bug.php?id=65236

Relevant patch: https://bugs.php.net/patch-display.php?bugid=65236&patch=bug65236.diff&revision=latest http://git.php.net/?p=php-src.git;a=commitdiff;h=7d163e8a0880ae8af2dd869071393e5dc07ef271

Stack-based buffer overflow in the phpmysqlndauthwrite function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument to the (a) mysqlconnect or (b) mysqliconnect function.

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the pharstreamflush function, leading to errors in the phpstreamwrapperlogerror function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of set, get, isset, and unset methods on objects accessed by a reference.

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2094 to the following vulnerability:

Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) pharstreamflush, (2) pharwrapperunlink, (3) pharparseurl, or (4) pharwrapperopenurl functions in ext/phar/stream.c; and the (5) pharwrapperopendir function in ext/phar/dirstream.c, which triggers errors in the phpstreamwrapperlogerror function.

References: [1] http://php-security.org/2010/05/14/mops-2010-024-php-pharstreamflush-format-string-vulnerability/index.html [2] http://php-security.org/2010/05/14/mops-2010-025-php-pharwrapperopendir-format-string-vulnerability/index.html [3] http://php-security.org/2010/05/14/mops-2010-026-php-pharwrapperunlink-format-string-vulnerability/index.html [4] http://php-security.org/2010/05/14/mops-2010-027-php-pharparseurl-format-string-vulnerabilities/index.html [5] http://php-security.org/2010/05/14/mops-2010-028-php-pharwrapperopenurl-format-string-vulnerabilities/index.html

Public PoC (from [1]):

$ php -r "fopen('phar:///usr/bin/phar.phar/%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');"

Credit: All flaws discovered by Stefan Esser.

PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension.

The zendrestoreinientrycb function in zendini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context-specific attackers to obtain sensitive information (memory contents) and cause a PHP crash by using the iniset function to declare a variable, then using the inirestore function to restore the variable.

The (1) parsestr, (2) pregmatch, (3) unpack, and (4) pack functions; the (5) ZENDFETCHRW, (6) ZENDCONCAT, and (7) ZENDASSIGNCONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's sleep function to interrupt an internal call to the shmputvar function, which triggers access of a freed resource.

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function.

PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the fileexists function.

The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the openbasedir protection mechanism via unspecified vectors.

The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PSUNDEFMARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

The phpmysqlndreaderrorfromline function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not properly calculate a buffer length, which allows context-dependent attackers to trigger a heap-based buffer overflow via crafted inputs that cause a negative length value to be used.

mysqlndwireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read sensitive memory via a modified length value, which is not properly handled by the phpmysqlndokread function; or (2) trigger a heap-based buffer overflow via a modified length value, which is not properly handled by the phpmysqlndrsetheaderread function.

The (1) striptags, (2) setcookie, (3) strtok, (4) wordwrap, (5) strwordcount, and (6) strpad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

The iconvmimedecodeheaders function in the Iconv extension in PHP before 5.3.4 does not properly handle encodings that are unrecognized by the iconv and mbstring (aka Multibyte String) implementations, which allows remote attackers to trigger an incomplete output array, and possibly bypass spam detection or have unspecified other impact, via a crafted Subject header in an e-mail message, as demonstrated by the ksc5601-1987 character set.

Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dependent attackers to cause a denial of service (application crash) via a large number of anti-aliasing steps in an argument to the imagepstext function.

Double free vulnerability in the imapdoopen function in the IMAP extension (ext/imap/phpimap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.

The mbstrcut function in Libmbfl 1.1.0, as used in PHP 5.3.x through 5.3.3, allows context-dependent attackers to obtain potentially sensitive information via a large value of the third parameter (aka the length parameter).

The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information by interrupting the handler for the (1) ZENDBWXOR opcode (shiftleftfunction), (2) ZENDSL opcode (bitwisexorfunction), or (3) ZENDSR opcode (shiftrightfunction), related to the converttolongbase function.

The pregquote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature, modification of ZVALs whose values are not updated in the associated local variables, and access of previously-freed memory.

Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.

The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via a deeply nested serialized variable, as demonstrated by a string beginning with a:1: followed by many {a:1: sequences.

The (1) trim, (2) ltrim, (3) rtrim, and (4) substrreplace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

The chunksplit function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.

The htmlentitydecode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.

fopenwrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass openbasedir restrictions via vectors related to the length of a filename.