A security flaw was found in the way the comprinttypeinfo() routine of the PHP scripting language processed certain COM object arguments. If a PHP language based application remotely accepted untrusted comprinttypeinfo() arguments in order to print out a PHP class definition for a dispatchable interface, a remote attacker could provide a specially-crafted COM object, which once processed by the application could lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
References: [1] https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255 [2] http://packetstormsecurity.org/files/112851/php54-exec.txt [3] http://www.exploit-db.com/exploits/18861/ [4] http://www.reddit.com/r/netsec/comments/tuyp3/iscdiaryphp54remoteexploitpocinthewild/
CVE request: [5] http://www.openwall.com/lists/oss-security/2012/05/20/1
CVE assignment: [6] http://www.openwall.com/lists/oss-security/2012/05/20/2
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.
PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.savepath directive.
The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mtrand functions.
An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a checkbad function in an attempt to block certain PHP functions such as eval, but does not prevent use of pregreplace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin template management.
Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmopread function.
Multiple format string vulnerabilities in pharobject.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zendthrowexceptionex call.
sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain phpgetopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
A security flaw was found in the way PHP performed soap.wsdlcachedir configuration directive validation before projecting SOAP WSDL cache content to the local filesystem. A remote attacker could use this flaw to place SOAP WSDL files at arbitrary file system locations (locations accessible with the privileges of the PHP application).
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221 [2] https://bugs.gentoo.org/showbug.cgi?id=459904 [3] http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/
Relevant upstream patch: [4] http://git.php.net/?p=php-src.git;a=commitdiff;h=702b436ef470cc02f8e2cc21f2fadeee42103c74
The procopen function in ext/standard/procopen.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safemodeallowedenvvars and (2) safemodeprotectedenvvars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LDLIBRARYPATH environment variable.
ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL pointer dereference and application crash) because com and comsafearrayproxy return NULL in compropertiesget in ext/comdotnet/comhandlers.c, as demonstrated by a serialize call on COM("WScript.Shell").
ext/standard/varunserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
The phpopensslapplyverificationpolicy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect "sanity check for the color index."
Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.
Integer overflow in the xmlutf8decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
The posixmkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-dependent attackers to bypass openbasedir restrictions, and create FIFO files, via the pathname and mode arguments, as demonstrated by creating a .htaccess file.
Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
XMB is vulnerable to cross-site scripting (XSS) due to inadequate filtering of BBCode input. This bug affects all versions of XMB. All XMB installations must be updated to versions 1.9.12.03 or 1.9.11.16.
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
https://bugs.php.net/bug.php?id=53502
[2010-12-08 21:04 UTC] jsheridan at tenable dot com
Description: ------------ strtotime calls with a timezone embedded function correctly but continually use up memory. In a daemon program this becomes quickly fatal.
Test script: --------------- <?php while (true) { strtotime('Monday 00:00 Europe/Paris'); // Memory leak } ?>
<?php while (true) { datedefaulttimezoneset("Europe/Paris"); strtotime('Monday 00:00'); // No memory leak } ?>
Expected result: ---------------- Memory usage should remain stable.
https://bugs.php.net/bug.php?id=55776
[2011-09-24 19:21 UTC] grinyad at mail dot ru
Description: ------------ <?php
// make a PdoMysql statement before
$result = $stmt->fetch(PDO::FETCHLAZY);
sessionstart();
$SESSION['PDORow'] = $result; ?>
Is crashing on next request after saving PDORow to session on sessionstart()
[2011-09-24 19:24 UTC] aharvey
What do you mean by "crashing"? Is the actual PHP process crashing, or are you just getting an error message because PDO statements aren't serialisable (which is expected)?
[2011-09-25 08:56 UTC] grinyad at mail dot ru
Is a Apache crash. It gives a CGI/FastCGI Send/Don't Send window.
http://img171.imageshack.us/img171/3953/57126366.jpg
After few minutes is crashing apache server:
http://img840.imageshack.us/img840/2981/21231006.jpg
[2011-09-25 12:39 UTC] johannes
PDORow objects may not be serialized and therefore not be put in a session. In svn it was fixed to throw a warning and not crash anymore this will be in future releases.
The extract function in PHP before 5.2.15 does not prevent use of the EXTROVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain phpgetopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
Integer overflow in the mtrand function in PHP before 5.3.4 might make it easier for context-dependent attackers to predict the return values by leveraging a script's use of a large max parameter, as demonstrated by a value that exceeds mtgetrandmax.
A security flaw was found in the way SOAP parser of PHP processed certain SOAP objects (due to allowed expansion of XML external entities during SOAP WSDL files parsing, it was previously possible to read arbitrary system files, accessible with the privileges of the PHP application). If a PHP application accepted untrusted SOAP object input remotely from clients, an attacker could use this flaw for unauthorized of read system files (accesible with the privileges of the PHP application).
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221 [2] https://bugs.gentoo.org/showbug.cgi?id=459904 [3] http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/
Relevant upstream patch: [4] http://git.php.net/?p=php-src.git;a=commitdiff;h=c737b89473df9dba6742b8fc8fbf6d009bf05c36
Heap-based buffer overflow in the phpquotprintencode function in ext/standard/quotprint.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to the quotedprintableencode function.
Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows context-dependent attackers to cause a denial of service (application hang) via a large argument to the jdtojewish function.
Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmtsetsymbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409.