Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2952-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2952-1 advisory. It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this...

Amazon Linux: Security Advisory (ALAS-2016-640)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2016-1903

CVE-2016-1903 affects PHP’s gdImageRotateInterpolated in ext/gd/libgd/gd_interpolation.c. Affected are PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2. A large bgd_color argument to imagerotate allows remote attackers to perform an out-of-bounds read, potentially disclosing memory co...

Amazon Linux AMI : php56 / php55 (ALAS-2016-640)

The imagerotate function lacked validation of the background color variable, an integer which represents an index of the color palette. A number larger than the length of the color palette could be used in the function, reading beyond the memory of the color palette and causing an information lea...

Medium: php56, php55

Issue Overview: The imagerotate function lacked validation of the background color variable, an integer which represents an index of the color palette. A number larger than the length of the color palette could be used in the function, reading beyond the memory of the color palette and causing an...

SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6069)

Missing bounds checks of an error in the imageRotate function of the gd extension potentially allowed attackers to read portions of memory. CVE-2008-5498 The mbstring.funcoverload in .htaccess was applied to other virtual hosts on th same machine. CVE-2009-0754 %NASLMINLEVEL 70300 C Tenable Netwo...

Mandriva Linux Security Advisory : php (MDVSA-2009:021)

A buffer overflow in the imageloadfont function in PHP allowed context-dependent attackers to cause a denial of service crash and potentially execute arbitrary code via a crafted font file CVE-2008-3658. A buffer overflow in the memnstr function allowed context-dependent attackers to cause a deni...

CVE-2008-5498

Array index error in the imageRotate function in PHP 5.2.8 and earlier allows context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument aka the bgdcolor or clrBack argument for an indexed image...