CVE-2004-1063

PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safemodeexecdir restrictions and execute commands outside of the intended safemodeexecdir via shell metacharacters in the current directory name. NOTE: this issue was...

CVE-2004-2692

The execdir PHP patch php-exec-dir 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the phpescapeshellcmd function...

Multiple PHP bugs

Integer overflow leading to memory content leak, safe mode protection bypass, openlog buffer overflow, etc...

security flaw

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via 1 a negative offset value to the shmopwrite function, 2 an "integer overflow/underflow" in the pack function, or 3 an "integer...

PHP shmop.c module permits write of arbitrary memory.

Hi list-eners, ========================================================== Title: Php shmop write of arbitrary memory - Safe Mode Bypass Affected: Php = 5.0.2 & 4.3.9 if shmop module is loaded. Vulnerability Type: Input Validation - write of arbitrary memory ==Summary Shared Memory PHP Module has ...

PHP 4.x5.0 Shared Memory Module - Offset Memory Corruption

PHP 4.x5.0 Shared Memory Module - Offset Memory Corruption source: https://www.securityfocus.com/bid/12045/info PHP shared memory module shmop is reported prone to an integer handling vulnerability. The issue exists in the PHPFUNCTIONshmopwrite function and is as a result of a lack of sufficient...

PHP 4.x/5.0 Shared Memory Module - Offset Memory Corruption

source: https://www.securityfocus.com/bid/12045/info PHP shared memory module shmop is reported prone to an integer handling vulnerability. The issue exists in the PHPFUNCTIONshmopwrite function and is as a result of a lack of sufficient sanitization performed on 'offset' data. This vulnerability...

GLSA-200412-14 : PHP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200412-14 PHP: Multiple vulnerabilities Stefan Esser and Marcus Boerger reported several different issues in the unserialize function, including serious exploitable bugs in the way it handles negative references CAN-2004-1019...

phpmyadmin -- command execution vulnerability

A phpMyAdmin security announcement reports: Command execution: since phpMyAdmin 2.6.0-pl2, on a system where external MIME-based transformations are activated, an attacker can put into MySQL data an offensive value that starts a shell command when browsed. Enabling PHP safe mode on the server can...

CVE-2004-1064

The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute...

CVE-2004-1018

CVE-2004-1018 affects PHP versions before 4.3.10, due to integer handling errors in shmop_write, pack, and unpack. These flaws could allow a remote attacker to bypass safe mode restrictions, cause denial of service, or execute arbitrary code. Several advisories (Ubuntu USN-99-1, Red Hat RHSA advi...

CVE-2004-1064

CVE-2004-1064 affects PHP 4.x up to 4.3.9 and PHP 5.x up to 5.0.2, where safe mode checks truncate the file path before feeding data to realpath, enabling a bypass of safe mode. The vulnerability is a path-length-related bypass of restriction checks, potentially allowing unauthorized access or ex...

CVE-2004-1063

PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safemodeexecdir restrictions and execute commands outside of the intended safemodeexecdir via shell metacharacters in the current directory name. NOTE: this issue was...

CVE-2004-1018

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via 1 a negative offset value to the shmopwrite function, 2 an "integer overflow/underflow" in the pack function, or 3 an "integer...

CVE-2004-1063

CVE-2004-1063 affects PHP 4.x up to 4.3.9 and PHP 5.x up to 5.0.2 when running in safe mode on multithreaded Unix webservers. It allows local users to bypass safe_mode_exec_dir restrictions and run commands outside the intended directory by using shell metacharacters in the current directory name...

CVE-2004-1018: Undefined Security Weakness

Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via 1 a negative offset value to the shmopwrite function, 2 an "integer overflow/underflow" in the pack function, or 3 an "integer...

CVE-2004-1064: Undefined Security Weakness

The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute...

GLSA-200410-14 : phpMyAdmin: Vulnerability in MIME-based transformation system

The remote host is affected by the vulnerability described in GLSA-200410-14 phpMyAdmin: Vulnerability in MIME-based transformation system A defect was found in phpMyAdmin's MIME-based transformation system, when used with 'external' transformations. Impact : A remote attacker could exploit this...

Debian DSA-168-1 : php - bypassing safe_mode, CRLF injection

Wojciech Purczynski found out that it is possible for scripts to pass arbitrary text to sendmail as commandline extension when sending a mail through PHP even when safemode is turned on. Passing 5th argument should be disabled if PHP is configured in safemode, which is the case for newer PHP...

CVE-2004-0838

Lexar Safe Guard for JumpDrive Secure 1.0 stores the password insecurely in memory using XOR encryption, which allows local users to read the password directly from the device and access the password protected part of the drive...