A security flaw was found in the way the comprinttypeinfo() routine of the PHP scripting language processed certain COM object arguments. If a PHP language based application remotely accepted untrusted comprinttypeinfo() arguments in order to print out a PHP class definition for a dispatchable interface, a remote attacker could provide a specially-crafted COM object, which once processed by the application could lead to that application crash, or, potentially arbitrary code execution with the privileges of the user running the application.
References: [1] https://isc.sans.edu/diary/PHP+5+4+Remote+Exploit+PoC+in+the+wild/13255 [2] http://packetstormsecurity.org/files/112851/php54-exec.txt [3] http://www.exploit-db.com/exploits/18861/ [4] http://www.reddit.com/r/netsec/comments/tuyp3/iscdiaryphp54remoteexploitpocinthewild/
CVE request: [5] http://www.openwall.com/lists/oss-security/2012/05/20/1
CVE assignment: [6] http://www.openwall.com/lists/oss-security/2012/05/20/2
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.
PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.savepath directive.
Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.
The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."
The initrequestinfo function in sapi/cgi/cgimain.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATHTRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mtrand functions.
Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmopread function.
Multiple format string vulnerabilities in pharobject.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zendthrowexceptionex call.
sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain phpgetopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
A security flaw was found in the way PHP performed soap.wsdlcachedir configuration directive validation before projecting SOAP WSDL cache content to the local filesystem. A remote attacker could use this flaw to place SOAP WSDL files at arbitrary file system locations (locations accessible with the privileges of the PHP application).
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221 [2] https://bugs.gentoo.org/showbug.cgi?id=459904 [3] http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:016/
Relevant upstream patch: [4] http://git.php.net/?p=php-src.git;a=commitdiff;h=702b436ef470cc02f8e2cc21f2fadeee42103c74
The procopen function in ext/standard/procopen.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safemodeallowedenvvars and (2) safemodeprotectedenvvars directives, which allows context-dependent attackers to execute programs with an arbitrary environment via the env parameter, as demonstrated by a crafted value of the LDLIBRARYPATH environment variable.
Stack-based buffer overflow in the datefromISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding.
A vulnerability was found in the SplObjectStorage unserializer. If the PHP unserialize() function is used by a script on untrusted data provided by a remote attacker the attacker may be able to force an information leak or remote execution of code on the server.
This was reported by Stefan Esser at the SyScan'10 Conference in Singapore.
Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack vectors related to "missing sanity checks around exif processing."
The phpopensslapplyverificationpolicy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
Unspecified vulnerability in the imagecolortransparent function in PHP before 5.2.11 has unknown impact and attack vectors related to an incorrect "sanity check for the color index."
Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
The GENERATESEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mtrand functions and possibly bypass protection mechanisms that rely on an unknown initial seed.
Heap-based buffer overflow in pcrecompile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains multiple branches.
Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.
Integer overflow in the xmlutf8decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safemode are feasible.
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
The (1) rand and (2) mtrand functions in PHP 5.2.6 do not produce cryptographically strong random numbers, which allows attackers to leverage exposures in products that rely on these functions for security-relevant functionality, as demonstrated by the password-reset functionality in Joomla! 1.5.x and WordPress before 2.6.2, a different vulnerability than CVE-2008-2107, CVE-2008-2108, and CVE-2008-4102.
https://bugs.php.net/bug.php?id=53502
[2010-12-08 21:04 UTC] jsheridan at tenable dot com
Description: ------------ strtotime calls with a timezone embedded function correctly but continually use up memory. In a daemon program this becomes quickly fatal.
Test script: --------------- <?php while (true) { strtotime('Monday 00:00 Europe/Paris'); // Memory leak } ?>
<?php while (true) { datedefaulttimezoneset("Europe/Paris"); strtotime('Monday 00:00'); // No memory leak } ?>
Expected result: ---------------- Memory usage should remain stable.
https://bugs.php.net/bug.php?id=55776
[2011-09-24 19:21 UTC] grinyad at mail dot ru
Description: ------------ <?php
// make a PdoMysql statement before
$result = $stmt->fetch(PDO::FETCHLAZY);
sessionstart();
$SESSION['PDORow'] = $result; ?>
Is crashing on next request after saving PDORow to session on sessionstart()
[2011-09-24 19:24 UTC] aharvey
What do you mean by "crashing"? Is the actual PHP process crashing, or are you just getting an error message because PDO statements aren't serialisable (which is expected)?
[2011-09-25 08:56 UTC] grinyad at mail dot ru
Is a Apache crash. It gives a CGI/FastCGI Send/Don't Send window.
http://img171.imageshack.us/img171/3953/57126366.jpg
After few minutes is crashing apache server:
http://img840.imageshack.us/img840/2981/21231006.jpg
[2011-09-25 12:39 UTC] johannes
PDORow objects may not be serialized and therefore not be put in a session. In svn it was fixed to throw a warning and not crash anymore this will be in future releases.
The extract function in PHP before 5.2.15 does not prevent use of the EXTROVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.
sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain phpgetopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.