Moderate: Red Hat Security Advisory: rh-php56-php security update

Updated rh-php56-php packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Apache ActiveMQ 5.x < 5.13.0 Java Object Unserialization RCE

Binary data 9080.prm...

Session data truncation can lead to unserialization of user provided data

More info at https://www.drupal.org/SA-CORE-2016-001...

Session data truncation can lead to unserialization of user provided data

More info at https://www.drupal.org/SA-CORE-2016-001...

PT-2016-7910

Name of the Vulnerable Software and Affected Versions jakarta-commons-collections version 3.2.2 Description The issue allows for code-execution by unserialization. Recommendations For jakarta-commons-collections version 3.2.2, update to a version that fixes the security issues...

PT-2016-7909

Name of the Vulnerable Software and Affected Versions apache-commons-collections versions prior to 3.2.2 Description The issue allows for code execution by unserialization. Recommendations For versions prior to 3.2.2, update to version 3.2.2 to resolve the issue...

Design/Logic Flaw

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving 1 ArrayObject, 2 SplObjectStorage, and 3 SplDoublyLinkedList, which are mishandled during unserialization...

CVE-2015-6831

CVE-2015-6831 involves use-after-free triggered during unserialize() in SPL objects in PHP. Public details from the initial document indicate multiple SPL-related vectors (ArrayObject, SplObjectStorage, SplDoublyLinkedList) mishandled during unserialization, allowing remote code execution. Report...

CVE-2015-6831: Use After Free

Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors involving 1 ArrayObject, 2 SplObjectStorage, and 3 SplDoublyLinkedList, which are mishandled during unserialization...

OpenNMS Java Object Unserialization Remote Code Execution

This module exploits a vulnerability in the OpenNMS Java object which allows an unauthenticated attacker to run arbitrary code against the system. Module Options msf use exploit/linux/misc/opennms/javaserialize msf undefinedjavaserialize show actions ...actions... msf undefinedjavaserialize set...

Amazon Linux AMI : php56 (ALAS-2015-601)

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. CVE-2015-7803 A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the...

Amazon Linux: Security Advisory (ALAS-2015-602)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-601)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux AMI : php55 (ALAS-2015-602)

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. CVE-2015-7803 A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the...

Medium: php55

Issue Overview: As reported upstream https://bugs.php.net/bug.php?id=69720, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. CVE-2015-7803 A flaw was discovered in the way PHP performed object...

USN-2758-1 php5 vulnerabilities

It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. CVE-2015-5589 It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker cou...

PT-2015-3237

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.4.45 PHP versions 5.5.x prior to 5.5.29 PHP versions 5.6.x prior to 5.6.13 Description The issue is related to multiple use-after-free vulnerabilities in PHP, which can be exploited by a remote attacker to execute...

UBUNTU-CVE-2015-6834

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to 1 the Serializable interface, 2 the SplObjectStorage class, and 3 the SplDoublyLinkedList class, which are mishandled...

Amazon Linux: Security Advisory (ALAS-2015-584)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Amazon Linux: Security Advisory (ALAS-2015-583)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...