PHP 5.4.x < 5.4.19 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.19. It is, therefore, potentially affected by the following vulnerabilities : - A heap corruption error exists in numerous functions in the file 'ext/xml/xml.c'. CVE-2013-4113 / Bug 65236 - An...

CVE-2013-4113

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted document that is processed by the xmlparseintostruct function...

CVE-2013-4113: Out-of-bounds Write

ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted document that is processed by the xmlparseintostruct function...

PT-2013-4854

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.27 Description The issue is related to the improper consideration of parsing depth in the ext/xml/xml.c component. This can be exploited by remote attackers using a crafted document processed by the xml parse into...

PHP 5.3.x < 5.3.27 Multiple Vulnerabilities

According to its banner, the version of PHP 5.3.x installed on the remote host is prior to 5.3.27. It is, therefore, potentially affected by the following vulnerabilities: - A buffer overflow error exists in the function 'pdopgsqlerror'. Bug 64949 - A heap corruption error exists in numerous...

kernel: ext3: format string issues

fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application...

Ubuntu 12.04 LTS / 12.10 / 13.04 : pymongo vulnerability (USN-1897-1)

Jibbers McGee discovered that PyMongo incorrectly handled certain invalid DBRefs. An attacker could use this issue to cause PyMongo to crash, resulting in a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security...

Ubuntu: Security Advisory (USN-1897-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2013-2110

Heap-based buffer overflow in the phpquotprintencode function in ext/standard/quotprint.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted argument to the quotedprintableenco...

CVE-2013-2110: Improper Restriction of Operations within the Bounds of a Memory Buffer

Heap-based buffer overflow in the phpquotprintencode function in ext/standard/quotprint.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact via a crafted argument to the quotedprintableenco...

PHP 5.4.x < 5.4.16 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.16. It is, therefore, potentially affected by the following vulnerabilities: - An error exists in the mimetype detection of 'mp3' files that could lead to a denial of service. Bug 64830 - An error exist...

DEBIAN-CVE-2013-2015

The ext4orphandel function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service system hang via a crafted filesystem on removable media, as demonstrate...

PT-2013-1816 · Red Hat · Red Hat Jboss Enterprise Application Platform +1

Name of the Vulnerable Software and Affected Versions: JBoss Enterprise Application Platform EAP versions 4.3.0 CP10 through 6.0.1 JBoss Enterprise Web Platform EWP version 5.2.0 Description: The default configuration of the LdapLoginModule and LdapExtLoginModule modules allows remote attackers t...

CVE-2013-1635

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an...

CVE-2013-1635: Undefined Security Weakness

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an...

PT-2013-1332

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.22 PHP versions 5.4.x prior to 5.4.13 Description The issue is related to errors in privilege management in the ext/soap/soap.c component of the PHP interpreter. It allows a remote attacker to elevate their privileges...

JBoss: allows empty password to authenticate against LDAP

The default configuration of the 1 LdapLoginModule and 2 LdapExtLoginModule modules in JBoss Enterprise Application Platform EAP 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform EWP 5.2.0 allow remote attackers to bypass authentication via an empty password...

CVE-2012-6113

The opensslencrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data...

CVE-2012-6113: Exposure of Sensitive Information to an Unauthorized Actor

The opensslencrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data...

PT-2012-5414

Name of the Vulnerable Software and Affected Versions Midnight Commander version 4.8.5 Description The issue arises from improper handling of the MC EXT SELECTED or MC EXT ONLYTAGGED environment variables when multiple files are selected. This allows remote attackers to execute arbitrary commands...