1776 matches found
CVE-2016-3142
The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...
Out-of-bounds
The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...
CVE-2016-3142
CVE-2016-3142 : In PHP’s PHAR extension, phar_parse_zipfile (zip.c) can be triggered by placing a PK\x05\x06 signature at an invalid location, causing an out-of-bounds read. Affected PHP versions: before 5.5.33 and before 5.6.19. Impact per doc: remote attackers may obtain sensitive process-memor...
CVE-2016-3142
The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...
PHP 5.5.33 Invalid Memory Write
Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...
CVE-2016-3142
The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...
php -- multiple vulnerabilities
The PHP Group reports: Fileinfo: Fixed bug 71527 Buffer over-write in finfoopen with malformed magic file. mbstring: Fixed bug 71906 AddressSanitizer: negative-size-param -1 in mbflstrcut. Phar: Fixed bug 71860 Invalid memory write in phar on filename with \0 in name. SNMP: Fixed bug 71704...
UBUNTU-CVE-2016-3142
The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...
php: NULL pointer dereference in phar_get_fp_offset()
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
php: uninitialized pointer in phar_make_dirstream()
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
php: Files from archive can be extracted outside of destination directory using phar
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
Moderate: Red Hat Security Advisory: rh-php56-php security update
Updated rh-php56-php packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...
php: segmentation fault in Phar::convertToData on invalid file
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
php: buffer overflow and stack smashing error in phar_fix_filepath
A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...
Fedora 22 : php-5.6.19-1.fc22 (2016-baa32758d0)
03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...
openSUSE Security Update : php5 (openSUSE-2016-323)
This update for php5 fixes the following issues : - CVE-2016-2554: A stack overflow vulnerability when decompressing tar phar archives was fixed. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Updat...
PHP PHAR 'ext/phar/tar.c' Stack Buffer Overflow Vulnerability
PHP PHP: Hypertext Preprocessor is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. PHP PHAR 'ext/phar/tar.c' suffers from a stack buffer overflow vulnerability due to the program failing to adequately check user-supplied input...
Fedora 23 : php-5.6.19-1.fc23 (2016-c0853ea24e)
03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...
Fedora 22 : php-5.6.18-1.fc22 (2016-1bc6ca8445)
04 Feb 2016, PHP 5.6.18 Core: Fixed bug php71039 exec functions ignore length but look for NULL termination. Anatol Fixed bug php71089 No check to duplicate zendextension. Remi Fixed bug php71201 round segfault on 64-bit builds. Anatol Added support for new HTTP 451 code. Julien Fixed bug php7127...
Fedora 21 : php-5.6.14-1.fc21 (2015-366f3dd73f)
01 Oct 2015, PHP 5.6.14 Core: Fixed bug php70370 Bundled libtool.m4 doesn't handle FreeBSD 10 when building extensions. Adam CLI server: Fixed bug php68291 404 on urls with '+'. cmb DOM: Fixed bug php70001 Assigning to DOMNode::textContent does additional entity encoding. cmb Mysqlnd: Fixed bug...