CVE-2014-9732

CVE-2014-9732 affects libmspack: the cabd_extract function mishandles decompression callbacks when a crafted CAB follows a valid file, enabling DoS via NULL pointer dereference and crash. Public details are in the NVD description and OSV/SUSE advisories; fixes were released in SUSE advisories SUS...

CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

CVE-2015-4470

Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted CAB archive...

CVE-2015-4471

CVE-2015-4471 affects libmspack (component: lzxd_decompress in lzxd.c) with an off-by-one error in pre-0.5 versions. A crafted CAB archive can trigger a denial of service via a buffer under-read. Affected products are libmspack deployments; remote attackers can exploit it without authentication. ...

CVE-2015-4470

Off-by-one error in the inflate function in mszipd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer over-read and application crash via a crafted CAB archive...

CVE-2014-9732

The cabdextract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted CAB...

CVE-2015-4470

CVE-2015-4470 is an off-by-one error in the inflate function (mszipd.c) of libmspack prior to 0.5, enabling remote DoS (buffer over-read) via a crafted CAB archive. Several advisories note fixes in libmspack via SUSE security updates (e.g., SUSE-SU-2015/2016-1x) addressing this and related CVEs (...

CVE-2014-9732

The cabdextract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service NULL pointer dereference and application crash via a crafted CAB...

CVE-2015-4471

Off-by-one error in the lzxddecompress function in lzxd.c in libmspack before 0.5 allows remote attackers to cause a denial of service buffer under-read and application crash via a crafted CAB archive...

jar: directory traversal vulnerability

A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted...

CVE-2015-4021

The pharparsetarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service integer underflow and memory...

CVE-2015-3329

Multiple stack-based buffer overflows in the pharsetinode function in pharinternal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a 1 tar, 2 phar, or 3 ZIP archive...

CVE-2015-3307

The pharparsemetadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service heap metadata corruption or possibly have unspecified other impact via a crafted tar archive...

Integer overflow

The pharparsetarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service integer underflow and memory...

CVE-2015-3307

The pharparsemetadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service heap metadata corruption or possibly have unspecified other impact via a crafted tar archive...

Design/Logic Flaw

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service buffer over-read and application crash via a crafted length value in conjunction with crafted serialized data ...

Heap overflow

The pharparsemetadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service heap metadata corruption or possibly have unspecified other impact via a crafted tar archive...

Stack overflow

Multiple stack-based buffer overflows in the pharsetinode function in pharinternal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a 1 tar, 2 phar, or 3 ZIP archive...

CVE-2015-3329

CVE-2015-3329 describes multiple stack-based buffer overflows in PHP’s Phar handling (phar_set_inode in phar_internal.h) that allow remote code execution via crafted length values in tar, phar, or ZIP archives. Affected PHP releases are 5.4.40 and earlier (5.4.x), 5.5.x prior to 5.5.24, and 5.6.x...

CVE-2015-3329

Multiple stack-based buffer overflows in the pharsetinode function in pharinternal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a 1 tar, 2 phar, or 3 ZIP archive...