USN-2952-1: PHP vulnerabilities

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. CVE-2014-9767 It was discovered that the PHP Soap client incorrectly validated data types. A remote...

Fedora 22 : php-5.6.19-1.fc22 (2016-baa32758d0)

03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...

Fedora 23 : php-5.6.19-1.fc23 (2016-c0853ea24e)

03 Mar 2016, PHP 5.6.19 CLI server: Fixed bug php71559 Built-in HTTP server, we can download file in web by bug. Johannes, Anatol CURL: - Fixed bug php71523 Copied handle with new option CURLOPTHTTPHEADER crashes while curlmultiexec. Laruence Date: Fixed bug php68078 Datetime comparisons ignore...

Fedora 22 : php-5.6.17-1.fc22 (2016-5207e0c1a1)

07 Jan 2016, PHP 5.6.17 Core: Fixed bug php66909 configure fails utf8tomutf7 test. Michael Orlitzky Fixed bug php70958 Invalid opcode while using ::class as trait method paramater default value. Laruence Fixed bug php70957 self::class can not be resolved with reflection for abstract class. Laruen...

Fedora 23 : php-5.6.17-1.fc23 (2016-558167a417)

07 Jan 2016, PHP 5.6.17 Core: Fixed bug php66909 configure fails utf8tomutf7 test. Michael Orlitzky Fixed bug php70958 Invalid opcode while using ::class as trait method paramater default value. Laruence Fixed bug php70957 self::class can not be resolved with reflection for abstract class. Laruen...

PHP FPM 'fpm_log.c' Buffer Overflow Vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community. A buffer overflow vulnerability in PHP FPM 'fpmlog.c' allows remote attackers to exploit the vulnerability to submit a special request to crash the application...

php54 security and bug fix update

php54 2.0-1 - fix incorrect selinux contexts 1194332 php54-php 5.4.40-1 - rebase to PHP 5.4.40 for various security fix 1209887 5.4.37-1 - rebase to PHP 5.4.37 5.4.36-1 - rebase to PHP 5.4.36 1168193 - fix package name in description - php-fpm own session dir php54-php-pecl-zendopcache 7.0.4-3 -...

Internet Bug Bounty: PHP-FPM fpm_log.c memory leak and buffer overflow

The FastCGI Process Manager FPM SAPI of PHP was vulnerable to memory leak and buffer overflow in the access logging feature. PHP-FPM offers customization of the access log lines based on format string variables which can be specified with the access.format option of the FPM configuration file. Th...

eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection

eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection ============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY...

eBay Magento <= 1.9.2.1 - PHP FPM XML eXternal Entity Injection Vulnerability

Exploit for php platform in category web applications ============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY...

eBay Magento XXE Injection

============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY ------------------------- eBay Magento CE = 1.9.2.1 XML eXternal Entit...

eBay Magento 1.9.2.1 - PHP FPM XML eXternal Entity Injection

============================================= - Release date: 29.10.2015 - Discovered by: Dawid Golunski - Severity: High/Critical - eBay Magento ref.: APPSEC-1045 ============================================= I. VULNERABILITY ------------------------- eBay Magento CE = 1.9.2.1 XML eXternal Entit...

Updated php-ZendFramework packages fix CVE-2015-5161

Updated php-ZendFramework packages fix security vulnerability: Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML...

Updated php-ZendFramework packages fix CVE-2015-5161

Updated php-ZendFramework and php-ZendFramework2 packages fix security vulnerability: Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attacker...

PHP cgimode fpm writeprocmemfile bypass disable function demo Vulnerability

Exploit for php platform in category web applications ?php errorreporting0x66778899; settimelimit0x41424344; define'ZENDINIUSER', 10; define'ZENDINIPERDIR', 11; define'ZENDINISYSTEM', 12; / 00df9000-00e16000 rw-p 00000000 00:00 0 017ff000-01a51000 rw-p 00000000 00:00 0 heap...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile disable_functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile disablefunctions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

PHP 5.5.9 - zend_executor_globals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library

PHP 5.5.9 - zendexecutorglobals CGIMode FPM WriteProcMemFile Disable Functions Bypass Load Dynamic Library ?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344;...

PHP 5.5.9 - 'zend_executor_globals' 'CGIMode FPM WriteProcMemFile' disable_functions Bypass / Load Dynamic Library

?php // EDB Note: Paper https://www.exploit-db.com/docs/english/38104-shoot-zendexecutorglobals-to-bypass-php-disablefunctions.pdf errorreporting0x66778899; settimelimit0x41424344; define'ZENDINIUSER', 10; define'ZENDINIPERDIR', 11; define'ZENDINISYSTEM', 12; / 00df9000-00e16000 rw-p 00000000 00:...

Debian DLA-302-1 : zendframework security update

Dawid Golunski discovered that when running under PHP-FPM in a threaded environment, Zend Framework, a PHP framework, did not properly handle XML data in multibyte encoding. This could be used by remote attackers to perform an XML External Entity attack via crafted XML data. For Debian 6 'Squeeze...

CVE-2015-5161

The ZendXmlSecurity::scan in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity XXE and XML entity expansion XEE...