ext/standard/varunserializer.re in PHP 7.0.x through 7.0.22 and 7.1.x through 7.1.8 is prone to a heap use after free while unserializing untrusted data, related to improper use of the hash API for key deletion in a situation with an invalid array size. Exploitation of this issue can have an unspecified impact on the integrity of PHP.
Upstream patch:
https://github.com/php/php-src/commit/1a23ebc1fff59bf480ca92963b36eba5c1b904c4
Upstream bug:
https://bugs.php.net/bug.php?id=74103
Fixed bug (Stack Buffer Overflow in msgfmtparsemessage). (CVE-2017-11362)
Fixed bug (Heap buffer overread (READ: 1) finishnesteddata from unserialize). (CVE-2017-12933)
Fixed bug (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
A use-after-free vulnerability was found in unserialize().
Upstream bug:
https://bugs.php.net/bug.php?id=72978
Upstream patch:
https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
An invalid read occurs when wddx decodes empty boolean element, leading to arbitrary memory read or crash.
Upstream bug:
https://bugs.php.net/bug.php?id=73631
Upstream patch:
https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
Fixed bug (wddxdeserialize use-after-free). (CVE-2016-7413)
ext/spl/splarray.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.
An out-of-bounds heap read was found in pharparsezipfile due to not checking entry.uncompressedfilesize.
Upstream bug:
https://bugs.php.net/bug.php?id=72928
Upstream patch:
https://github.com/php/php-src/commit/0bfb970f43acd1e81d11be1154805f86655f15d5?w=1
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
Fixed bug (wddxdeserialize allows illegal memory access). (CVE-2016-7129)
Fixed bug (imagegammacorrect allows arbitrary write access). (CVE-2016-7127)
Fixed bug (selectcolors write out-of-bounds). (CVE-2016-7126)
ext/standard/varunserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) destruct call or (2) magic method call.
Fixed bug (heap-buffer-overflow (write) simplestringaddn simplestring.c). (CVE-2016-6296)
A use-after-free vulnerability in with GC and unserialize() was found.
Upstream bug:
https://bugs.php.net/bug.php?id=72479
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=cab1c3b3708eead315e033359d07049b23b147a3
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
Calling to ulocacceptLanguageFromHTTP with parameter size "httpAcceptLanguage" equal or greater than ULOCFULLNAMECAPACITY + 1, the local variable "tmp" might leave unterminated. ulocacceptLanguageFromHTTP doesn’t check status result after call to uloccanonicalize. This might cause stack data leak.
PHP bug:
https://bugs.php.net/bug.php?id=72533
PHP fix:
http://git.php.net/?p=php-src.git;a=commit;h=aa82e99ed8003c01f1ef4f0940e56b85c5b032d4
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
An out-of-bounds access due to lack of size check of buffer may lead to memory buffer overflow.
Upstream bug:
https://bugs.php.net/bug.php?id=72603
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=eebcbd5de38a0f1c2876035402cb770e37476519
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
A use-after-free vulnerability was found in unserialize() with Unexpected Session Deserialization.
Upstream bug:
https://bugs.php.net/bug.php?id=72562
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=3798eb6fd5dddb211b01d41495072fd9858d4e32
CVE assignment:
http://seclists.org/oss-sec/2016/q3/137
A use after free vulnerability was discovered when PHP's garbage collection algorithm interacts with other specific PHP objects. This vulnerability has wide reaching effects like allowing the exploitation of unserialize to gain remote code execution on a target system.
Upstream bug:
https://bugs.php.net/bug.php?id=72434
Upstream patch:
http://git.php.net/?p=php-src.git;a=commitdiff;h=f6aef68089221c5ea047d4a74224ee3deead99a6
CVE assignment:
http://seclists.org/oss-sec/2016/q2/589
Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
A format string vulnerability was found in phpsnmperror() in ext/snmp/snmp.c, possibly leading to code execution. snmpobject->snmperrstr is passed directly to zendthrowexceptionex() without a "%s".
Upstream bug:
https://bugs.php.net/bug.php?id=71704
Upstream patch:
https://git.php.net/?p=php-src.git;a=commit;h=6e25966544fb1d2f3d7596e060ce9c9269bbdcf8
An invalid write vulnerability causing segmentation fault in phar on filename with \0 inside its name was found.
Vulnerable code (pharanalyzepath):
if (!(realpath = expandfilepath(filename, NULL))) { efree(filename); return FAILURE; } #ifdef PHPWIN32 pharunixifypathseparators(realpath, strlen(realpath)); #endif slash = strstr(realpath, filename); if (slash) { slash += ((ext - fname) + extlen); slash = '\0'; }
If fname and thus filename contain \0's, realpath would not contain those parts and thus slash would point past the end of the realpath buffer.
To exploit this, application has to allow attacker to create phar files with arbitrary filenames.
Upstream bug:
https://bugs.php.net/bug.php?id=71860
Upstream patch:
https://gist.github.com/smalyshev/80b5c2909832872f2ba2 https://git.php.net/?p=php-src.git;a=commit;h=1e9b175204e3286d64dfd6c9f09151c31b5e099a
Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)