74 matches found
CVE-2015-4147
The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...
Type confusion
The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...
CVE-2015-4147
The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...
CVE-2015-4147
CVE-2015-4147 affects PHP’s SOAP extension. The vulnerability is in SoapClient::__call in ext/soap/soap.c where __default_headers is not verified to be an array, enabling a type confusion that allows remote code execution via crafted serialized data. Affected versions: PHP before 5.4.39, 5.5.x be...
CVE-2015-4147
The SoapClient::call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that defaultheaders is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a...
Fedora 21 : php-5.6.7-1.fc21 (2015-4236)
19 Mar 2015, PHP 5.6.7 Core : - Fixed bug 69174 leaks when unused inner class use traits precedence. Laruence - Fixed bug 69139 Crash in gczvalpossibleroot on unserialize. Laruence - Fixed bug 69121 Segfault in getcurrentuser when script owner is not in passwd with ZTS build. dan at syneto dot ne...
[SECURITY] [DSA 3198-2] php5 regression update
------------------------------------------------------------------------- Debian Security Advisory DSA-3198-2 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso March 28, 2015 http://www.debian.org/security/faq -...
PHP SoapClient Type Obfuscation Information Disclosure Vulnerability
PHP SoapClient is a SOAP client application. A type confusion vulnerability exists in certain methods of the PHP SoapClient object, which allows an attacker to exploit the vulnerability to obtain arbitrary memory sensitive information...
PHP 5.5.x < 5.5.23 Multiple Vulnerabilities
According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.23. It is, therefore, affected by multiple vulnerabilities : - A use-after-free error exists related to function 'unserialize', which can allow a remote attacker to execute arbitrary code. Note that thi...
Internet Bug Bounty: Type Confusion Vulnerability in SoapClient
Type Confusion Vulnerability in SoapClient Taoguang Chen - Write Date: 2015.3.1 - Release Date: 2015.3.20 A type confusion vulnerability was discovered in SoapClient object's getCookies method that can be abused for leaking arbitrary memory blocks or execute arbitrary code remotely. Affected...
Internet Bug Bounty: SoapClient's __call() type confusion through unserialize()
https://bugs.php.net/bug.php?id=69085 Description: ------------ SoapClient's call method is prone to a type confusion vulnerability which can be used to gain remote code execution through unsafe unserialize calls. In soap.c:2906 if zendhashfindZOBJPROPPthisptr, "defaultheaders",...
Mandriva Linux Security Advisory : php (MDVSA-2013:016)
Multiple vulnerabilities has been discovered and corrected in php : PHP does not validate the configration directive soap.wsdlcachedir before writing SOAP wsdl cache files to the filesystem. Thus an attacker is able to write remote wsdl files to arbitrary locations CVE-2013-1635. PHP allows the u...
PT-2013-14: XML External Entities Injection in PHP
The specialists of Positive Technologies have detected an "XXE" vulnerability in PHP. The vulnerability was detected in the PHP's built-in SoapClient and SoapServer classes. PHP allows the use of external entities while parsing SOAP wsdl files which allows an attacker to read arbitrary files. If ...
PT-2013-12: open_basedir bypass in PHP
The specialists of Positive Technologies have detected bypass of the configuration directive "openbasedir" in PHP. The vulnerability was detected in the PHP's built-in SoapClient class. PHP does not validate the configration directive "soap.wsdlcachedir" before writing SOAP wsdl cache files to th...