Fixed bug (Unserialize use-after-free when resizing object's properties hash table). (CVE-2016-7479)
Fixed bug (wddxdeserialize() heap out-of-bound read via phpparsedate()). (CVE-2017-11145)
A stack buffer overflow exists in the latest stable release of PHP-7.1.5 and PHP-5.6.30 in PHP INI parsing API, which may accept network / local filesystem input. On malformed inputs, a stack buffer overflow in zendinidoop() could write 1-byte off a fixed size stack buffer. On installations with the stack smashing mitigation, this would cause an immediate DoS; upto optimization levels, build options and stack buffer overflow mitigations, this vulnerability may allow corrupting other local variables or the frame pointer, potentially allows remotely executing code.
Upstream bug:
https://bugs.php.net/bug.php?id=74603
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=5f8380d33e648964d2d5140f329cf2d4c443033c http://git.php.net/?p=php-src.git;a=commit;h=05255749139b3686c8a6a58ee01131ac0047465e http://git.php.net/?p=php-src.git;a=commit;h=88c521d659521f695e0b9e7fcdded0fc1ee1c53b
Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.
A flaw was found in php. The GIF decoding function gdImageCreateFromGifCtx in gdgifin.c (which can be reached with a call to the imagecreatefromstring() function) uses constant-sized color tables of size 3 256, but does not zero-out these arrays before use. This flaw could lead to a information leak through a specially crafted image with bogus color table.
Upstream bug:
https://bugs.php.net/bug.php?id=74435
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=018092125538782b25d3ab6b036f0c8d5968f757 http://git.php.net/?p=php-src.git;a=commit;h=8dc4f4dc9e44d1cbfe4654aa6e0dc27c94913938 https://bugs.php.net/patch-display.php?bug=74435&patch=fix-74435-php-7.0&revision=1497970038
References:
http://php.net/ChangeLog-5.php
Fixed bug (AddressSanitizer: negative-size-param (-1) in mbflstrcut). (CVE-2016-4073)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
A heap corruption vulnerability when parsing tar/zip/phar file with empty content.
Upstream bug:
https://bugs.php.net/bug.php?id=71354
Upstream patch:
https://git.php.net/?p=php-src.git;a=commitdiff;h=13ad4d3e971807f9a58ab5933182907dc2958539
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
Fixed bug (bcpowmod accepts negative scale and corrupts one definition). (CVE-2016-4537, CVE-2016-4538)
Fixed bug (negative-size-param (-1) in memcpy in zifopensslseal()). (CVE-2017-11144)
Fixed bug (xmlparseintostruct segmentation fault). (CVE-2016-4539)
Fixed bug (Out of bounds heap read access in exif header processing). (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (Out-of-bounds reads in zifgraphemestripos with negative offset). (CVE-2016-4540, CVE-2016-4541)
Fixed bug (phpsnmperror() Format String Vulnerability). (CVE-2016-4071)
DISPUTED Integer overflow in the phprawurlencode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not)."
Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Format string vulnerability in the zendthroworerror function in Zend/zendexecuteAPI.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Fixed bug (imagefilltoborder stackoverflow on truecolor images). (CVE-2016-9933)
ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
A use-after-free vulnerability was found in unserialize().
Upstream bug:
https://bugs.php.net/bug.php?id=72978
Upstream patch:
https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
An invalid read occurs when wddx decodes empty boolean element, leading to arbitrary memory read or crash.
Upstream bug:
https://bugs.php.net/bug.php?id=73631
Upstream patch:
https://github.com/php/php-src/commit/66fd44209d5ffcb9b3d1bc1b9fd8e35b485040c0
CVE assignment:
http://seclists.org/oss-sec/2016/q4/658
PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::toString with DateInterval::wakeup.
Use-after-free vulnerability in the CURLFile implementation in ext/curl/curlfile.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during wakeup processing.
Integer signedness error in the dynamicGetbuf function in gdiodp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.
ext/intl/msgformat/msgformatformat.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a MessageFormatter::formatMessage call with a long first argument.
A null pointer vulnerability was found in function wddxdeserialize.
Upstream bug:
https://bugs.php.net/bug.php?id=73065
Upstream patch:
https://github.com/php/php-src/commit/c4cca4c20e75359c9a13a1f9a36cb7b4e9601d29?w=1
CVE assignment:
http://seclists.org/oss-sec/2016/q3/518
Fixed bug (wddxdeserialize use-after-free). (CVE-2016-7413)