Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
An out-of-bounds access due to lack of size check of buffer may lead to memory buffer overflow.
Upstream bug:
https://bugs.php.net/bug.php?id=72603
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=eebcbd5de38a0f1c2876035402cb770e37476519
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
Calling to ulocacceptLanguageFromHTTP with parameter size "httpAcceptLanguage" equal or greater than ULOCFULLNAMECAPACITY + 1, the local variable "tmp" might leave unterminated. ulocacceptLanguageFromHTTP doesn’t check status result after call to uloccanonicalize. This might cause stack data leak.
PHP bug:
https://bugs.php.net/bug.php?id=72533
PHP fix:
http://git.php.net/?p=php-src.git;a=commit;h=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
Fixed bug (heap-buffer-overflow (write) simplestringaddn simplestring.c). (CVE-2016-6296)
A use-after-free vulnerability in with GC and unserialize() was found.
Upstream bug:
https://bugs.php.net/bug.php?id=72479
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=cab1c3b3708eead315e033359d07049b23b147a3
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
A use-after-free vulnerability was found in unserialize() with Unexpected Session Deserialization.
Upstream bug:
https://bugs.php.net/bug.php?id=72562
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=3798eb6fd5dddb211b01d41495072fd9858d4e32
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
A use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system.
Upstream bug:
https://bugs.php.net/bug.php?id=72434
Upstream patch:
http://git.php.net/?p=php-src.git;a=commitdiff;h=f6aef68089221c5ea047d4a74224ee3deead99a6
CVE assignment:
http://seclists.org/oss-sec/2016/q2/589
/ext/phar/pharobject.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.