Fedora 24 : php-5.6.20-1.fc24 (2016-ace6f06a4d)

31 Mar 2016, PHP 5.6.20 CLI Server: Fixed bug php69953 Support MKCALENDAR request method. Christoph Core: Fixed bug php71596 Segmentation fault on ZTS with date function setlocale. Anatol Curl: - Fixed bug php71694 Support constant CURLMADDEDALREADY. mpyw Date: - Fixed bug php71635...

PHP 5.6.x < 5.6.20 Multiple Vulnerabilities

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.20. It is, therefore, affected by multiple vulnerabilities : - A buffer over-write condition exists in the finfoopen function due to improper validation of magic files. An unauthenticated, remote...

FreeBSD : php -- multiple vulnerabilities (482d40cb-f9a3-11e5-92ce-002590263bf5)

The PHP Group reports : - Fileinfo : - Fixed bug 71527 Buffer over-write in finfoopen with malformed magic file. - mbstring : - Fixed bug 71906 AddressSanitizer: negative-size-param -1 in mbflstrcut. - Phar : - Fixed bug 71860 Invalid memory write in phar on filename with \0 in name. - SNMP : -...

PHP PHAR extension 'phar_parse_zipfile' function buffer overflow vulnerability

PHP is an open source general-purpose computer scripting language maintained by the PHP Group and the open source community.PHAR is one of the archived extensions. A security vulnerability exists in the 'pharparsezipfile' function in the zip.c file of PHP's PHAR extension, which allows a remote...

PHP 5.5.33 - Invalid Memory Write

PHP 5.5.33 - Invalid Memory Write Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- ca...

PHP 5.5.33 - Invalid Memory Write

Exploit for php platform in category dos / poc Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script:...

PHP 5.5.33 - Invalid Memory Write

Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...

CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

Out-of-bounds

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

CVE-2016-3142

CVE-2016-3142 : In PHP’s PHAR extension, phar_parse_zipfile (zip.c) can be triggered by placing a PK\x05\x06 signature at an invalid location, causing an out-of-bounds read. Affected PHP versions: before 5.5.33 and before 5.6.19. Impact per doc: remote attackers may obtain sensitive process-memor...

CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

UBUNTU-CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

PHP 5.5.33 Invalid Memory Write

Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...

CVE-2016-3142

The pharparsezipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and application crash by placing a PK\x05\x06 signature at an inval...

php -- multiple vulnerabilities

The PHP Group reports: Fileinfo: Fixed bug 71527 Buffer over-write in finfoopen with malformed magic file. mbstring: Fixed bug 71906 AddressSanitizer: negative-size-param -1 in mbflstrcut. Phar: Fixed bug 71860 Invalid memory write in phar on filename with \0 in name. SNMP: Fixed bug 71704...

php: NULL pointer dereference in phar_get_fp_offset()

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...

php: uninitialized pointer in phar_make_dirstream()

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...

php: segmentation fault in Phar::convertToData on invalid file

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...

php: Files from archive can be extracted outside of destination directory using phar

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened...