Fixed bug (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
Fixed bug (wddxdeserialize() heap out-of-bound read via phpparsedate()). (CVE-2017-11145)
A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop() could write 1-byte off a fixed size stack buffer. On installations with the stack smashing mitigation, this would cause an immediate DoS; upto optimization levels, build options and stack buffer overflow mitigations, this vulnerability may allow corrupting other local variables or the frame pointer, potentially allows remotely executing code.
Upstream bug:
https://bugs.php.net/bug.php?id=74603
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=5f8380d33e648964d2d5140f329cf2d4c443033c http://git.php.net/?p=php-src.git;a=commit;h=05255749139b3686c8a6a58ee01131ac0047465e http://git.php.net/?p=php-src.git;a=commit;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b
The SplObjectStorage unserialize implementation in ext/spl/splobserver.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.
A flaw was found in php. The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 256, but does not zero-out these arrays before use. This flaw could lead to a information leak through a specially crafted image with bogus color table.
Upstream bug:
https://bugs.php.net/bug.php?id=74435
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=018092125538782b25d3ab6b036f0c8d5968f757 http://git.php.net/?p=php-src.git;a=commit;h=8dc4f4dc9e44d1cbfe4654aa6e0dc27c94913938 https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038
References:
http://php.net/ChangeLog-5.php
Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
A heap corruption vulnerability when parsing tar/zip/phar file with empty content.
Upstream bug:
https://bugs.php.net/bug.php?id=71354
Upstream patch:
https://git.php.net/?p=php-src.git;a=commitdiff;h=13ad4d3e971807f9a58ab5933182907dc2958539
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (integer overflow in ZipArchive::getFrom). (CVE-2016-3078)
An infinite loop vulnerability was found in ext/iconv/iconv.c in PHP due to the iconv stream not rejecting invalid multibyte sequences. A remote attacker could use this vulnerability to hang the php process and consume resources.
An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exifreaddata in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exifiifaddvalue mishandles the case of a MakerNote that lacks a final '\0' character.
Fixed bug (Seg fault when loading hostile phar). (CVE-2017-11147)
Fixed bug (negative-size-param (-1) in memcpy in zifopensslseal()). (CVE-2017-11144)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Uninitialized pointer in pharmakedirstream()). (CVE-2016-4343)
Fixed bug (phpsnmperror() Format String Vulnerability). (CVE-2016-4071)
DISPUTED Integer overflow in the phprawurlencode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not)."
Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxmldisableentityloader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collatorsort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
It was found that PCRE before 8.38 mishandles certain repeated conditional groups whose condition was referenced by name if there was more than one group with the given name, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.