The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
A heap corruption vulnerability when parsing tar/zip/phar file with empty content.
Upstream bug:
https://bugs.php.net/bug.php?id=71354
Upstream patch:
https://git.php.net/?p=php-src.git;a=commitdiff;h=13ad4d3e971807f9a58ab5933182907dc2958539
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Uninitialized pointer in pharmakedirstream()). (CVE-2016-4343)
main/phpopentemporaryfile.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses.
A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize().
Upstream bug (currently private):
https://bugs.php.net/bug.php?id=68594
Upstream commit:
http://git.php.net/?p=php-src.git;a=commitdiff;h=630f9c33c23639de85c3fd306b209b538b73b4c9 http://git.php.net/?p=php-src.git;a=commitdiff;h=53f129a44d3c4ec0fae57993b9ae2f6cb48973cc
Note that unserialize() is unsafe for use on untrusted inputs, as is documented in the PHP manual for the function:
http://php.net/manual/en/function.unserialize.php
An integer overflow flaw in PHP's unserialize() function was reported. If unserialize() were used on untrusted data, this issue could lead to a crash or potentially information disclosure. It is not clear if code execution is possible or not.
It was reported that this issue only affects 32-bit systems. It has been fixed in upstream versions 5.4.34, 5.5.18, and 5.6.2.
References: http://git.php.net/?p=php-src.git;a=commit;h=56754a7f9eba0e4f559b6ca081d9f2a447b3f159 https://bugs.php.net/bug.php?id=68044 http://php.net/ChangeLog-5.php
An out-of-bounds read flaw was found in PHP's mkgmtime() function. This could possibly cause the PHP interpreter to crash.
This issue has been fixed in upstream versions 5.4.34, 5.5.18, and 5.6.2.
References: http://git.php.net/?p=php-src.git;a=commit;h=88412772d295ebf7dd34409534507dc9bcac726e https://bugs.php.net/bug.php?id=68027 http://php.net/ChangeLog-5.php
A heap corruption issue was reported in PHP's exifthumbnail() function. A specially-crafted JPEG image could cause the PHP interpreter to crash or, potentially, execute arbitrary code.
This issue has been fixed in upstream versions 5.4.34, 5.5.18, and 5.6.2.
References: http://git.php.net/?p=php-src.git;a=commit;h=ddb207e7fa2e9adeba021a1303c3781efda5409b https://bugs.php.net/bug.php?id=68113 http://php.net/ChangeLog-5.php
An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file. This could possibly lead to file executable crash.
Upstream fix:
https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0
It was found [1] that there's an issue in php which in some cases may lead to remote code execution.
[1]: https://bugs.php.net/bug.php?id=68088
The odbcbindcols function in ext/odbc/phpodbc.c in PHP before 5.6.12 mishandles driver behavior for SQLWVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbcfetcharray function to access a certain type of Microsoft SQL Server table.
The opensslrandompseudobytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RANDpseudobytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Stack consumption vulnerability in Zend/zendexceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.
It was found that PCRE before 8.38 mishandles certain repeated conditional groups whose condition was referenced by name if there was more than one group with the given name, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.
PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
It was discovered that pcrecompile function in pcrecompile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression.
pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.