VulnCheck KEV: CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

RCE 'Bug' Found and Disputed in Popular PHP Scripting Framework

Versions of the popular developer tool Zend Framework and its successor Laminas Project can be abused by an attacker to execute remote code on PHP-based websites, if they are running web-based applications that are vulnerable to attack. However, those that maintain Zend Framework emphasize that t...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

Deserialization of untrusted data

DISPUTED Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no...

CVE-2021-3007

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

CVE-2021-3007

Laminas-http

PT-2021-18593 · Zend +1 · Zend Framework +1

Name of the Vulnerable Software and Affected Versions: Laminas Project laminas-http versions prior to 2.14.2 Zend Framework version 3.0.0 Description: The issue is related to a deserialization vulnerability that can lead to remote code execution if the content is controllable. This is due to the...

CVE-2021-3007: Deserialization of Untrusted Data

Laminas Project laminas-http before 2.14.2, and Zend Framework 3.0.0, has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the destruct method of the Zend\Http\Response\Stream class in Stream.php. NOTE: Zend Framework is no longer...

Laminas Project laminas-http and Zend Framework Code Issues Vulnerabilities

ZEND Zend Framework is an open source PHP development framework from ZEND Corporation, which is mainly used for developing web programs and services.Laminas Project laminas-http is an HTTP message and header abstraction and HTTP client implementation of the Laminas Project. A code issue...

Evangelion1204 Multi-ini Resource Management Error Vulnerability

Evangelion1204 Multi-ini is Evangelion1204 individual developers of a Javascript-based language written for Ini configuration file parsing code base . The code base supports compatibility with the Zend file format. A security vulnerability exists in versions of multi-ini prior to 2.1.1, which ste...

PT-2020-22169

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the functions zend is inconsistent, zend hash find, an...

php:php-fuzz-execute: Heap-use-after-free in ZEND_ASSIGN_OBJ_SPEC_VAR_CONST_OP_DATA_CONST_HANDLER

Detailed Report: https://oss-fuzz.com/testcase?key=4924276489322496 Project: php Fuzzing Engine: honggfuzz Fuzz Target: php-fuzz-execute Job Type: honggfuzzasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x617000026de8 Crash State:...

OSV-2020-1787 Use-of-uninitialized-value in zend_generator_search_multi_children_node

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25678 Crash type: Use-of-uninitialized-value Crash state: zendgeneratorsearchmultichildrennode zendgeneratoraddchild zendgeneratoryieldfrom...

PT-2020-21972

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves several functions: zend generator search multi children node...

PT-2020-21969

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves several functions: zend gc addref, zend generator update current,...

PT-2020-21966

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type known as Memcpy-param-overlap. The crash state involves several functions: zend lex tstring, zendparse, and zend...

PT-2020-21965

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free READ 4 crash type. The crash state involves gc mark grey, gc mark roots, and zend gc collect cycles...

PT-2020-21963

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-use-after-free READ 1 crash type. The crash state involves several function calls, including zend assign to variable, zend s...