Fedora 26 : php (2018-c71dd2e199)

PHP version 7.1.16 29 Mar 2018 Core: - Fixed bug php76025 Segfault while throwing exception in errorhandler. Dmitry, Laruence - Fixed bug php76044 'date: illegal option -- -' in ./configure on FreeBSD. Anatol FPM: - Fixed bug php75605 Dumpable FPM child processes allow bypassing opcache access...

PT-2018-19266

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The issue allows bypassing opcache access controls due to dumpable FPM child processes. This is related to php75605. Recommendations At the moment, there is no information about a newer version...

PT-2018-3138

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.6.35 PHP versions 7.0.x prior to 7.0.29 PHP versions 7.1.x prior to 7.1.16 PHP versions 7.2.x prior to 7.2.4 Description The issue is related to the lack of protection for service data in PHP's FPM child processes,...

PHP 5.x < 7.1.20, 7.2.x < 7.2.8, 7.3.0alpha1 < 7.3.0alpha3 DoS Vulnerability - Linux

PHP is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PHP 5.x < 7.1.20, 7.2.x < 7.2.8, 7.3.0alpha1 < 7.3.0alpha3 DoS Vulnerability - Windows

PHP is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

CVE-2015-9253

An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...

CVE-2015-9253

An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...

CVE-2015-9253: Uncontrolled Resource Consumption

An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions e.g., passthru, exec, shellexec, or system with a non-blocking STDIN stream, causing this...

Fedora 26 : php (2018-c4e9207c31)

PHP version 7.1.13 04 Jan 2018 Core: - Fixed bug php75573 Segmentation fault in 7.1.12 and 7.0.26. Laruence - Fixed bug php75384 PHP seems incompatible with OneDrive files on demand. Anatol - Fixed bug php74862 Unable to clone instance when private clone defined. Daniel Ciochiu - Fixed bug php750...

CVE-2015-3211

php-fpm allows local users to write to or create arbitrary files via a symlink attack...

CVE-2015-3211

php-fpm allows local users to write to or create arbitrary files via a symlink attack...

CVE-2015-3211

php-fpm allows local users to write to or create arbitrary files via a symlink attack...

CVE-2015-3211

Technical details about CVE-2015-3211 are not publicly available in the provided documents. Monitor for updates from vendors/security bulletins.

CVE-2015-3211

php-fpm allows local users to write to or create arbitrary files via a symlink attack...

PT-2017-6646

Name of the Vulnerable Software and Affected Versions php-fpm affected versions not specified Description The issue allows local users to write to or create arbitrary files via a symlink attack. Recommendations At the moment, there is no information about a newer version that contains a fix for...

CVE-2015-3211: Improper Link Resolution Before File Access

php-fpm allows local users to write to or create arbitrary files via a symlink attack...

XML External Entity (XXE) Attacks

Zendframework and several Zendservices are vulnerable to XML External Entity XXE attacks. The libxmldisableentityloader is not correctly shared between threads then PHP-FPM is used, allowing attackers to conduct XXE attacks. This is as a result of an incomplete fix for CVE-2012-5657...

The vulnerability of the PHP interpreter, which allows attackers to escalate their privileges

The vulnerability of the apache2handler/modphp or php-fpm configuration of the PHP interpreter exists due to deficiencies in access control during the inheritance of certain classes related to the operating code. Exploiting this vulnerability allows a malicious actor to enhance their privileges...

CVE-2015-8994

CVE-2015-8994 concerns PHP 5.x and 7.x when using apache2handler/mod_php or php-fpm with OpCache enabled. In affected SAPIs, Zend OpCache creates a shared memory object owned by the common parent during initialization, and child processes inherit its descriptor. This can allow opcode cache data t...

CVE-2015-8994

An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/modphp or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validatepermission=1 setting. The vulnerability details a...