CVE-2007-2728

The soap extension in PHP calls phprandr with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcryptcreateiv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue...

Fedora Core 6 : php-5.1.6-3.6.fc6 (2007-503)

This update fixes a number of security issues in PHP. A heap buffer overflow flaw was found in the PHP 'xmlrpc' extension. A PHP script which implements an XML-RPC server using this extension could allow a remote attacker to execute arbitrary code as the 'apache' user. Note that this flaw does no...

PT-2007-4044 · Php · Php

Name of the Vulnerable Software and Affected Versions: PHP affected versions not specified Description: A design error in the make http soap request function in PHP's soap extension causes it to call php rand r with an uninitialized variable, potentially leading to weak encryption of sensitive...

Mandrake Linux Security Advisory : php (MDKSA-2007:102)

A heap buffer overflow flaw was found in the xmlrpc extension for PHP. A script that implements an XML-RPC server using this extension could allow a remote attacker to execute arbitrary code as the apache user. This flaw does not, however, affect PHP applications using the pure-PHP XMLRPC class...

CentOS 5 : php (CESA-2007:0348)

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A...

php security update

CentOS Errata and Security Advisory CESA-2007:0348 Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting langua...

php make_http_soap_request flaw

Buffer overflow in the makehttpsoaprequest function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" slash characters...

CVE-2007-2510

Buffer overflow in the makehttpsoaprequest function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" slash characters...

php make_http_soap_request flaw

Buffer overflow in the makehttpsoaprequest function in PHP before 5.2.2 has unknown impact and remote attack vectors, possibly related to "/" slash characters...

Important: Red Hat Security Advisory: php security update

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. A...

webMethods Glue Management Console Directory Traversal

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 11-Apr-2007 Software: webMethods - webMethods Glue Management Console http://www.webmethods.com/ "With webMethods Glue developers can easily create SOAP interfaces for their existing Java and C/C++...

MOPB-44-2007:PHP 5.2.0 Memory Manager Signed Comparision Vulnerability

Summary The new Zend Memory Manager that shipped with PHP 5.2.0 contains a comparison that wrongly casts some numbers to signed integers. Therefore a request for a very large amount of memory will be handled as a negative number and therefore result in only a minimum sized memory block being...

CVE-2007-1889

Integer signedness error in the zendmmallocint function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msgreceive wi...

CVE-2007-1889

Integer signedness error in the zendmmallocint function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msgreceive wi...

CVE-2007-1889

Integer signedness error in the zendmmallocint function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msgreceive wi...

n.runs-SA-2007.006 - PHProjekt 5.2.0 - Privilege escalation

n.runs AG http://www.nruns.com/ security at nruns.com n.runs-SA-2007.006 14-Mar-2007 Vendor: Mayflower GmbH, http://www.mayflower.de Affected Products: PHProjekt 5.2.0 Vulnerability: Privilege escalation Risk: HIGH Vendor communication: 2006/12/31 initial notification of Mayflower 2007/01/02...

MDKA-2007:009 : perl-SOAP-Lite

SOAP::Lite makes use of auto-generated methods with names that clash with methods exported by UNIVERSAL::require. As a result, using the two modules simultaneously will result in an immediate program crash. The package has been patched with an upstream fix to correct the issue. %NASLMINLEVEL 9999...

OWASP JBroFuzz 0.3 Fuzzer Released!

JBroFuzz is an OWASP Project that emerged from penetration testing. It deals with fuzzing stateless network protocols such as HTTP, SOAP, XML, LDAP, etc. Apart from fancy terminology, JBroFuzz 0.3 has inbuilt the following Generators ready to be used: basic cross site scripting checks XSS basic S...

IBM WebSphere Application Server SOAP Connector Error Page XSS

The remote SOAP server fails to sanitize user input via the URI before using it to generate dynamic XML content in an error page. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary XML into a user's browser. %NASLMINLEVEL 70300 C Tenable Network Security,...

IBMWAS-XSS.txt

Title: Cross Site Scripting XSS Vulnerability in IBM WebSphere Application Server ProCheckUp Security Bulletin Description: IBM WebSphere Application Server is vulnerable to Cross Site Scripting through a 'faultfactor' tag in the 500 Internal Server Error page on port 8880 default SOAP port. Date...