In PHP versions 8.1. before 8.1.34, 8.2. before 8.2.30, 8.3. before 8.3.29, 8.4. before 8.4.16, 8.5. before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTREMULATEPREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdoparseparams() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

The Next action in PEAR HTMLQuickFormController 1.0.4 includes the SID in the URL even when session.useonlycookies is configured, which allows remote attackers to obtain the SID via an HTTP Referer field and possibly other vectors.

According to https://www.php.net/manual/en/security.cgi-bin.force-redirect.php, the configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL like http://host.example/cgi-bin/php/secretdir/script.php. The default value of cgi.forceredirect is 1.

But there is a bug that can cause attackers to bypass restrictions and access php-cgi directly.

PHP is vulnerable to an integer overflow in the mysqliapi.c:mysqlirealescapestring() function. An attacker could exploit this by performing a crafted query to cause a crash.

Upstream Bug:

https://bugs.php.net/bug.php?id=74544

PHP through is vulnerable to an out of bounds access in the phppcre.c:phppcrereplaceimpl() function. An attacker could exploit this by calling pregreplace() with crafted arguments.

Upstream Bug:

https://bugs.php.net/bug.php?id=74604

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more restrictive permissions. This may result in files having more lax permissions than intended when such archive is extracted.

Reference: https://bugs.php.net/bug.php?id=79082

Common Vulnerabilities and Exposures assigned an identifier CVE-2006-4484 to the following vulnerability:

Buffer overflow in the LWZReadByte function in ext/gd/libgd/gdgifin.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with inputcodesize greater than MAXLWZBITS, which triggers an overflow when initializing the table array.

References: http://bugs.php.net/bug.php?id=38112 http://cvs.php.net/viewvc.cgi/php-src/ext/gd/libgd/gdgifin.c?r1=1.10&r2=1.11 http://www.php.net/ChangeLog-5.php#5.1.5

It was reported [1],[2] that there was an integer overflow in PHP's shmopread() function. This function reads a given number of bytes from memory, at a given offset starting from a shared memory area. With a sufficiently large value, more memory is allocated than there is space for, which could result in a segfault because PHP is reading past its own memory. If there is enough allocated memory available, however, PHP could leak up to 2GB of arbitrary memory.

To test:

<?php $shmkey = ftok(FILE, 't'); $shmid = shmopopen($shmkey, "c", 0644, 100); $shmdata = shmopread($shmid, 1, 2147483647); //if there is no segmentation fault past this point, we have 2gb of memory! echo $shmdata; ?>

This sets a start value of 1, and 2^31 (2147483647) as the count:

2147483647+1 = -2147483647

This was corrected upstream [3] for version 5.3.6.

References:

[1] http://openwall.com/lists/oss-security/2011/03/08/9 [2] http://bugs.php.net/54193 [3] http://svn.php.net/viewvc/?view=revision&revision=309018

End of life: 8/14/2014, End of support: 6/30/2011, Latest version: 5.3.29

End of life: 8/14/2014, End of support: 6/30/2011, Latest version: 5.3.29

End of life: 9/5/2005, End of support: 9/5/2005, Latest version: 5.0.5

End of life: 9/5/2005, End of support: 9/5/2005, Latest version: 5.0.5

End of life: 11/30/2020, End of support: 11/30/2019, Latest version: 7.2.34

End of life: 11/30/2020, End of support: 11/30/2019, Latest version: 7.2.34

End of life: 12/31/2018, End of support: 1/19/2017, Latest version: 5.6.40

End of life: 12/31/2018, End of support: 1/19/2017, Latest version: 5.6.40

End of life: 1/6/2011, End of support: 11/2/2008, Latest version: 5.2.17

End of life: 1/6/2011, End of support: 11/2/2008, Latest version: 5.2.17

End of life: 11/26/2023, End of support: 11/26/2022, Latest version: 8.0.30

End of life: 11/26/2023, End of support: 11/26/2022, Latest version: 8.0.30

End of life: 12/31/2026, End of support: 12/31/2024, Latest version: 8.2.33

End of life: 12/31/2026, End of support: 12/31/2024, Latest version: 8.2.33

End of life: 9/14/2015, End of support: 9/14/2014, Latest version: 5.4.45

End of life: 9/14/2015, End of support: 9/14/2014, Latest version: 5.4.45

End of life: 8/24/2006, End of support: 8/24/2006, Latest version: 5.1.6

End of life: 8/24/2006, End of support: 8/24/2006, Latest version: 5.1.6

End of life: 11/28/2022, End of support: 11/28/2021, Latest version: 7.4.33

End of life: 11/28/2022, End of support: 11/28/2021, Latest version: 7.4.33

End of life: 12/31/2027, End of support: 12/31/2025, Latest version: 8.3.33