PT-2017-19450

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The issue involves security vulnerabilities in PHP, including an Out-Of-Bounds Read in the timelib meridian function within the Date module and a crash in the php-mcrypt module due to the Arcfour...

Fedora 25 : php (2017-cdaaf6ea12)

PHP version 7.0.25 26 Oct 2017 Core: - Fixed bug php75241 NULL pointer dereference in zendmmallocsmall. Laruence - Fixed bug php75236 infinite loop when printing an error-message. Andrea - Fixed bug php75252 Incorrect token formatting on two parse errors in one request. Nikita - Fixed bug php7522...

CVE-2017-15582

In net.MCrypt in the "Diary with lock" aka WriteDiary application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries...

Code injection

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

CVE-2014-8686

CodeIgniter vulnerability CVE-2014-8686 (CodeIgniter before 2.2.0) allows attackers to decode and manipulate the ci_session cookie by falling back to a custom XOR-based scheme when the PHP Mcrypt extension is unavailable. Public references describe exploitation via extracting the encryption key, ...

CVE-2014-8686: Undefined Security Weakness

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available...

PT-2017-6257

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 2.2.0 Description The issue makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available. Recommendation...

PT-2017-16819

Name of the Vulnerable Software and Affected Versions sysPass versions 2.0 through 2.1 Description An issue was discovered in sysPass where an algorithm was never sufficiently reviewed by cryptographers. The use of the MCRYPT RIJNDAEL 256 function, which is the 256-bit block version of Rijndael a...

Information Disclosure

mcrypt is vulnerable to information exposure. The vulnerability exists because TLS, SSH, and IPSec protocols have missing validate birthday bound which allows to remote attack access confidential information in system...

USN-3045-1 PHP vulnerabilities | Cloud Foundry

USN-3045-1 PHP vulnerabilities Medium Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.18 Note: The PHP buildpack is patched from upstream PHP source Description It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker...

SUSE SLES11 Security Update : php53 (SUSE-SU-2016:2013-1)

php53 was updated to fix five security issues. These security issues were fixed : - CVE-2016-5769: mcrypt: Heap Overflow due to integer overflows bsc986388. - CVE-2015-8935: XSS in header with Internet Explorer bsc986004. - CVE-2016-5772: Double Free Courruption in wddxdeserialize bsc986244. -...

PHP 'ext/mcrypt/mcrypt.c' Heap Overflow Vulnerability

PHP is an open source general-purpose computer scripting language. A heap overflow vulnerability exists in PHP 'ext/mcrypt/mcrypt.c', which allows an attacker to exploit the vulnerability to execute arbitrary script code in the context of an affected application...

PHP '/ext/mcrypt/mcrypt.c' incomplete fix exists for multiple integer overflow vulnerabilities

PHP is an open source general-purpose computer scripting language. PHP '/ext/mcrypt/mcrypt.c' incomplete fix exists for multiple integer overflow vulnerabilities. Allows an attacker to execute arbitrary code within the context of an affected application...

CVE-2016-5769

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted length value,...

CVE-2016-5769

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted length value,...

Integer overflow

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted length value,...

CVE-2016-5769

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service heap-based buffer overflow and application crash or possibly have unspecified other impact via a crafted length value,...