Missing error checking could result in SQL injection and missing error handling could lead to crashes due to null pointer dereferences.

This is related to https://www.postgresql.org/support/security/CVE-2025-1094/ that was reported to postgres. The reporter used php to showcase the problem.

While working on addressing the report, it was realised that PHP uses the escape functions in a way that does not allow for errors to be reported. Specifically the error parameters is not passed to PQescapeStringConn(), which therefore cannot report an error.

While postgres now tries to make sure that the escaped string will trigger errors on the server-side if the string is invalidly encoded, that still can be insufficient, depending on how the escaped values are used.

It was also noted that several calls to PQescapeIdentifier() do not check for the returned value being NULL, despite that being the documented way that PQescapeIdentifier() (and PQescapeLiteral()) to report errors. Seems like that could cause crashes or at least UB in some of the callsites.

The cdfcountchain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

Invalid pointer dereference flaws were found in the way file, utility for determining of file types processed header section for certain Composite Document Format (CDF) files. A remote attacker could provide a specially-crafted CDF file, which once inspected by the file utility of the victim would lead to file executable crash.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILEPSTRING conversion.

$COOKIE names string replacement (. -> ): cookie integrity vulnerabilities

A vulnerability was found in PHP where setting the environment variable PHPCLISERVERWORKERS to a large value leads to a heap buffer overflow.

Fixed bug (1-byte array overrun in common path resolve code). (CVE-2023-0568)

Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

Fixed bug : phar wrapper: DOS when using quine gzip file. (CVE-2022-31628)

Fixed bug : mysqlnd/pdo password buffer overflow. (CVE-2022-31626)

Fixed bug (SSRF bypass in FILTERVALIDATEURL). (CVE-2021-21705)

Fixed bug (Crash while parsing blob data in firebirdfetchblob). (CVE-2021-21704)

Fixed bug (special character is breaking the path in xml function). (CVE-2021-21707)

Fixed bug (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).

Fixed bug (Null Dereference in SoapClient). (CVE-2021-21702)

Last updated 24 July 2024

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.

Fixed bug (PDO::quote() may return unquoted string). (CVE-2022-31631)

In PHP versions 8.3. before 8.3.19 and 8.4. before 8.4.5, a code sequence involving set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

Fixed bug : buffer overflow in hashupdate() on long parameter. (CVE-2022-37454)

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.

Fixed bug (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)

Fixed bug (wddxdeserialize() heap out-of-bound read via phpparsedate()). (CVE-2017-11145)

A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop() could write 1-byte off a fixed size stack buffer. On installations with the stack smashing mitigation, this would cause an immediate DoS; upto optimization levels, build options and stack buffer overflow mitigations, this vulnerability may allow corrupting other local variables or the frame pointer, potentially allows remotely executing code.

Upstream bug:

https://bugs.php.net/bug.php?id=74603

Upstream patch:

http://git.php.net/?p=php-src.git;a=commit;h=5f8380d33e648964d2d5140f329cf2d4c443033c http://git.php.net/?p=php-src.git;a=commit;h=05255749139b3686c8a6a58ee01131ac0047465e http://git.php.net/?p=php-src.git;a=commit;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b

Fixed bug (wddx parsing empty boolean tag leads to SIGSEGV). (CVE-2017-11143)

The SplObjectStorage unserialize implementation in ext/spl/splobserver.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.

Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

A flaw was found in php. The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 256, but does not zero-out these arrays before use. This flaw could lead to a information leak through a specially crafted image with bogus color table.

Upstream bug:

https://bugs.php.net/bug.php?id=74435

Upstream patch:

http://git.php.net/?p=php-src.git;a=commit;h=018092125538782b25d3ab6b036f0c8d5968f757 http://git.php.net/?p=php-src.git;a=commit;h=8dc4f4dc9e44d1cbfe4654aa6e0dc27c94913938 https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038

References:

http://php.net/ChangeLog-5.php

Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)

Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)