Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / current : php (SSA:2010-024-02)

New php packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2010-024-02. The text itself ...

RHEL 4 / 5 : php (RHSA-2010:0040)

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0040 advisory. - php: exifreaddata crash on corrupted JPEG files CVE-2009-2687 - php: openssl extension: Incorrect verification of SSL certificate with...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 / 9.10 : php5 vulnerabilities (USN-882-1)

Maksymilian Arciemowicz discovered that PHP did not properly handle the inirestore function. An attacker could exploit this issue to obtain random memory contents or to cause the PHP server to crash, resulting in a denial of service. CVE-2009-2626 It was discovered that the htmlspecialchars...

php security update

5.1.6-24.5 - add security fix for CVE-2009-4142 543469 5.1.6-24.4 - build fix pdomysql on biarch systems 543469 5.1.6-24.3 - add security fixes for CVE-2009-2687, CVE-2009-3291, CVE-2009-3292, CVE-2009-3546 CVE-2009-4017 541597 - add build fix for mysqli on some biarch systems 543469...

FreeBSD Ports: php5

The remote host is missing an update to the system as announced in the referenced advisory. VID 39a25a63-eb5c-11de-b650-00215c6a37bb OpenVAS Vulnerability Test $ Description: Auto generated from VID 39a25a63-eb5c-11de-b650-00215c6a37bb Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

CVE-2009-4142

CVE-2009-4142 affects PHP up to version 5.2.12, where the htmlspecialchars function does not properly handle certain multi-byte encodings (overlong UTF-8, invalid Shift_JIS, and invalid EUC-JP). This can enable remote attackers to perform cross-site scripting (XSS) by placing a crafted byte seque...

CVE-2009-4142

creationtimestamp| type| source ---|---|--- 2009-12-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33415 2009-12-17 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/33414...

CVE-2008-4142

CVE-2008-4142 is a SQL injection vulnerability in E-Php CMS affecting article.php via the es_id parameter, allowing remote attackers to execute arbitrary SQL. The CVSSv2 base score is 7.5 (HIGH). The provided documents describe the vulnerability and its existence but do not detail a workaround or...

CVE-2008-4142

creationtimestamp| type| source ---|---|--- 2008-09-18 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6483...

Sql injection

Multiple SQL injection vulnerabilities in the Virtual War VWar 1.5.0 R15 module for PHP-Nuke allow remote attackers to execute arbitrary SQL commands via the n parameter to extra/online.php and other unspecified scripts in extra/. NOTE: this might be same vulnerability as CVE-2006-4142; however,...

CVE-2006-4142

SQL injection vulnerability in extra/online.php in Virtual War VWar 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter...

CVE-2006-4142

SQL injection vulnerability in extra/online.php in Virtual War VWar 1.5.0 R14 and earlier allows remote attackers to execute arbitrary SQL commands via the n parameter...

CVE-2006-4142

CVE-2006-4142 describes an SQL injection in Virtual War (VWar) 1.5.0 R14 and earlier, occurring in extra/online.php via the n parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands and has an attack surface classified as network with low complexity and no authentic...

CVE-2005-4142

CVE-2005-4142 affects Lyris ListManager 5.0–8.8b. The vulnerability lies in the web-based subscription form where the pw parameter can be crafted to inject arbitrary list-administration commands via LFCR sequences, exploiting insufficient input sanitization. This can allow an unauthenticated atta...