php: memory corruption in phar_parse_tarfile caused by empty entry file name

An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...

php security update

5.3.3-46 - fix gzfile accept paths with NUL character 1213407 - fix patch for CVE-2015-4024 5.3.3-45 - fix more functions accept paths with NUL character 1213407 5.3.3-44 - soap: missing fix for 1222538 and 1204868 5.3.3-43 - core: fix multipart/form-data request can use excessive amount of CPU...

php: memory corruption in phar_parse_tarfile caused by empty entry file name

An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...

The vulnerability of the ZENworks Configuration Management software allows a perpetrator to execute arbitrary code.

The vulnerability of the ZENworks Configuration Management information system exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially crafted directory name specified ...

The vulnerability of the SELinux access control system, allowing a perpetrator to execute arbitrary commands

The vulnerability of the SELinux access control system is related to improper handling of file names. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands by adding special metafiles to file names...

UBUNTU-CVE-2015-4026

The pcntlexec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument...

php: move_uploaded_file() NUL byte injection in file name

It was found that PHP moveuploadedfile function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions...

Hewlett-Packard Network Virtualization Information Disclosure Vulnerability

This vulnerability allows remote attackers to read arbitrary files on vulnerable installations of Hewlett-Packard Network Virtualization. Authentication is not required to exploit this vulnerability. The specific flaw exists because neither the HttpServlet nor the NetworkEditorController sanitize...

CVE-2014-9716

Cross-site scripting XSS vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name...

Cross site scripting

Cross-site scripting XSS vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name...

CVE-2014-9716

Cross-site scripting XSS vulnerability in WebODF before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via a file name...

TransmitMail vulnerable to directory traversal

Overview TransmitMail is a PHP based mail form. TransmitMail contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer und...

TransmitMail vulnerable to cross-site scripting

Overview TransmitMail is a PHP based mail form. TransmitMail contains a cross-site scripting CWE-79 vulnerability due to the processing of file names. Gen Sato of TRADE WORKS Co.,Ltd. Security Dept. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

MS15-034: Vulnerability in HTTP.sys could allow remote code execution: April 14, 2015

None None...

JVN#02527990: Lhaplus vulnerable to directory traversal

Lhaplus is a file compression/decompression software. Lhaplus contains an issue in processing file names, which may result in a directory traversal vulnerability. Impact Decompressing a file with a specially crafted file name may result in a creation of an arbitrary file or an overwrite of an...

PHP arbitrary file upload Vulnerability, CVE-2 0 1 5-2 3 4 8-a vulnerability warning-the black bar safety net

Security researchers today published a medium-risk vulnerabilities--PHP arbitrary file upload Vulnerability, CVE-2 0 1 5-2 3 4 8 in. In the Upload File only when the determined file name is the legal name of the file to conclude that this file is not malicious file, which will indeed lead to othe...

CVE-2015-1815

The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...

Design/Logic Flaw

The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name...

Scientific Linux Security Update : setroubleshoot on SL5.x, SL6.x, SL7.x i386/x86_64 (20150326)

It was found that setroubleshoot did not sanitize file names supplied in a shell command look-up for RPMs associated with access violation reports. An attacker could use this flaw to escalate their privileges on the system by supplying a specially crafted file to the underlying shell command...

PT-2015-1273 · Red Hat +1 · Setroubleshoot +2

Name of the Vulnerable Software and Affected Versions: setroubleshoot versions prior to 3.2.22 Description: The issue is related to incorrect file name handling, which can be exploited by remote attackers to execute arbitrary commands by adding shell metacharacters to file names. This is...