EUVD-2014-2051

Malware in sbrugna...

Crypt encryption compromised.

More info at https://fuelphp.com/security-advisories...

ImageMagick driver does not escape all shell arguments.

More info at https://fuelphp.com/security-advisories...

CVE-2014-1999

The auto-format feature in the RequestCurl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response...

CVE-2014-1999

The auto-format feature in the RequestCurl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response...

Format string

The auto-format feature in the RequestCurl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response...

CVE-2014-1999

The auto-format feature in the RequestCurl class in FuelPHP 1.1 through 1.7.1 allows remote attackers to execute arbitrary code via a crafted response...

CVE-2014-1999

CVE-2014-1999 affects FuelPHP’s Request_Curl class (versions 1.1–1.7.1) where an auto-format feature can process crafted responses and lead to arbitrary code execution on the application server. The root cause is unsafe auto-formatting of curl responses, enabling remote code execution when untrus...

FuelPHP vulnerable to remote code execution

Overview FuelPHP is a PHP web framework for creating web applications. FuelPHP applications contain an issue in the RequestCurl class, which may result in arbitrary code execution. Masaaki Chida of GREE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

JVN#94791545: FuelPHP vulnerable to remote code execution

FuelPHP is a PHP web framework for creating web applications. FuelPHP applications contain an issue in the RequestCurl class, which may result in arbitrary code execution. Impact When specially crafted input is processed, arbitrary files may be deleted or arbitrary code may be executed on the...

xss_clean() doesn't clean unicode EM-spaces

On some browsers, this can cause javascript execution if send unencoded to the browser. Since FuelPHP encodes everything send to a view by default, we don't think it's an immediate risk. All released versions are affected. XSS cleaning in FuelPHP is done by the external library htmlLawed. We have...