Fedora 30 : php (2019-ec40d89812)

PHP version 7.2.21 01 Aug 2019 Date: - Fixed bug php69044 discrepency between time and microtime. krakjoe EXIF: - Fixed bug php78256 heap-buffer-overflow on exifprocessusercomment. CVE-2019-11042 Stas - Fixed bug php78222 heap-buffer-overflow on exifscanthumbnail. CVE-2019-11041 Stas Fileinfo: -...

Fedora Update for php-typo3-phar-stream-wrapper2 FEDORA-2019-af7bef7165

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 29 Update: php-typo3-phar-stream-wrapper2-2.1.2-1.fc29

Interceptors for PHP's native phar:// stream handling v2. Autoloader: /usr/share/php/TYPO3/PharStreamWrapper2/autoload.php...

Fedora 29 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-af7bef7165)

Two security updates have been released for PharStreamWrapper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 30 Update: php-typo3-phar-stream-wrapper2-2.1.2-1.fc30

Interceptors for PHP's native phar:// stream handling v2. Autoloader: /usr/share/php/TYPO3/PharStreamWrapper2/autoload.php...

Fedora Update for php-typo3-phar-stream-wrapper2 FEDORA-2019-a8121923d5

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 30 : php-brumann-polyfill-unserialize / php-typo3-phar-stream-wrapper2 (2019-a8121923d5)

Two security updates have been released for PharStreamWrapper. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

Deserialization of untrusted data

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

CVE-2019-12868

app/Model/Server.php in MISP 2.4.109 allows remote command execution by a super administrator because the PHP fileexists function is used with user-controlled entries, and phar:// URLs trigger deserialization...

PT-2019-12993 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.109 Description: The issue allows remote command execution by a super administrator due to the use of the PHP file exists function with user-controlled entries. Specifically, phar:// URLs can trigger deserialization, leading ...

mybb -- vulnerabilities

mybb Team reports: High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...

Joomla! 1.7.x < 3.9.6 Multiple Vulnerabilities

According to its self-reported version number, the detected Joomla! application is affected by multiple vulnerabilities : - A protection bypass exists in versions 3.9.3 to 3.9.5 within the Phar Stream Wrapper Interceptor due to path traversal - A cross-site scripting XSS vulnerability exists in...

Drupal 8.7.x < 8.7.1 Third-Party Libraries Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or...

Drupal 7.x < 7.67 Third-Party Libraries Vulnerability

According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.67, 8.6.x prior to 8.6.16, or 8.7.x prior to 8.7.1. It is, therefore, affected by a path traversal vulnerability. This security release fixes third-party dependencies included in or...

Debian: Security Advisory (DLA-1797-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-1797-1 : drupal7 security update

Several security vulnerabilities have been discovered in drupal7, a PHP website platform. The vulnerabilities affect the embedded versions of the jQuery JavaScript library and the Typo3 Phar Stream Wrapper library. CVE-2019-11358 It was discovered that the jQuery version embedded in Drupal was...

Internet Bug Bounty: Null Pointer Dereference in phar_create_or_parse_filename

The original report is here https://bugs.php.net/bug.php?id=77396 Description: ------------ Please use these poc file: https://drive.google.com/file/d/1bzw-j4FtV7PEf6SW2GYmDVKtMybmbKnl/view?usp=sharing Test script: --------------- USEZENDALLOC=0 ../../php-7.1.25/sapi/cli/php -r '$phar=new...

Fedora Update for php-typo3-phar-stream-wrapper FEDORA-2019-d5f883429d

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...