CVE-2007-2872

Multiple integer overflows in the chunksplit function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service crash or execute arbitrary code via the 1 chunks, 2 srclen, and 3 chunklen arguments...

Integer overflow

Multiple integer overflows in the chunksplit function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service crash or execute arbitrary code via the 1 chunks, 2 srclen, and 3 chunklen arguments...

CVE-2007-2872

CVE-2007-2872: Multiple integer overflows in PHP’s chunk_split function affect PHP 5 prior to 5.2.3 and PHP 4 prior to 4.4.8. An attacker can provide crafted values for the third argument (chunklen) and related parameters (chunks, srclen) to trigger a crash or potentially execute arbitrary code r...

[Full-disclosure] SonicBB version 1.0 Multiple Path Disclosure Vulnerabilities

netVigilance Security Advisory 18 SonicBB version 1.0 Multiple Path Disclosure Vulnerabilities Description: SonicBB is a user-friendly and fully customizable bulletin board package. SonicBB is compatible with any web server/operating system combo with PHP 4.x or higher installed.SonicBB is the...

MOPB-41-2007:PHP 5 sqlite_udf_decode_binary() Buffer Overflow Vulnerability

Summary When sqliteudfdecodebinary is called with a string only containing a single 0x01 char this will result in a call to the sqlitedecodebinary function with an empty string as parameter. This leads to an exploitable buffer overflow. Affected versions Affected are PHP 4 4.4.5 and PHP 5 5.2.1...

MOPB-39-2007:PHP str_replace() Memory Allocation Integer Overflow Vulnerability

Summary When strreplace is called in a way that a single char is replaced by a long string and the single char occurs very often in the subject this will result in an integer overflow when the size of the memory buffer is calculated. The allocation of a too small buffer will result in a buffer...

MOPB-40-2007:PHP imap_mail_compose() Boundary Stack Buffer Overflow Vulnerability

Summary The imapmailcompose function of PHP that can be used to construct multipart emails will overflow a stack buffer when it is passed an overlong boundary string. This can lead to arbitrary code execution. Affected versions Affected are PHP 4 4.4.5 and PHP 5 5.2.1 Detailed information The...

CVE-2007-1888

Buffer overflow in the sqlitedecodebinary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. NOTE: some PHP installations use a bundled version of sqlite...

CVE-2007-1887

Buffer overflow in the sqlitedecodebinary function in the bundled sqlite library in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter, as demonstrated by calling the sqliteudfdecodebinary function with a...

CVE-2007-1888

Removed by vendor...

CVE-2007-1884

CVE-2007-1884 affects PHP 4.x before 4.4.5 and PHP 5.x before 5.2.1 on 64‑bit platforms. The vulnerability arises from integer signedness errors in the printf family, allowing context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers from 64→32 bit truncation...

CVE-2007-1887

CVE-2007-1887 concerns a buffer overflow in the sqlite_decode_binary function in the bundled sqlite library used by PHP. The issue affects PHP 4 before 4.4.5 and PHP 5 before 5.2.1, where an empty parameter value to sqlite_udf_decode_binary (0x01 character input) can enable context-dependent arbi...

CVE-2007-1825

CVE-2007-1825: Buffer overflow in PHP imap_mail_compose (PHP 5 < 5.2.1; PHP 4

MOPB-34-2007:PHP mail() Header Injection Through Subject and To Parameters

Summary The mail function converts control characters like linefeed or carriage return in the Subject and To parameters into spaces as a protection against email header injection. However an exception is made for folded mail headers that continue on the next line. Unfortunately the macro handling...

MOPB-35-2007:PHP 4 zip_entry_read() Integer Overflow Vulnerability

Summary The zipreadentry function that is used to read the content of a file stored inside a .ZIP archive is vulnerable to an integer overflow in memory allocation that leads to an exploitable bufferoverflow. Affected versions Affected are PHP 4 4.4.5 Detailed information The zipreadentry functio...

PHP 5.2.1 - Multiple functions 'Reference' Information Disclosures

source: https://www.securityfocus.com/bid/23202/info PHP is prone to an information-disclosure vulnerability due to a design error. The vulnerability resides in various functions that accept parameters as references. Successful exploits will allow attackers to obtain sensitive information...

MOPB-33-2007:PHP mail() Message ASCIIZ Byte Truncation

Summary When the mail function is called with a message that contains an ASCIIZ byte it considers it the end of the message. PHP applications not filtering ASCIIZ strings from user input before embedding it into the message are therefore vulnerable to arbitrary email truncation. Affected versions...

MOPB-26-2007:PHP mb_parse_str() register_globals Activation Vulnerability

Summary When the mbparsestr function, which is the multibyte variant of the parsestr function, is called with only one parameter and is interrupted by for example a memorylimit violation the registerglobals directive will get internally activated during the process and not deactivated. Therefore...

Integer overflow

Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286...

CVE-2007-1285

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service stack exhaustion and PHP crash via deeply nested arrays, which trigger deep recursion in the variable destruction routines...