CVE-2016-9137

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curlfile.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during wakeup processing...

CVE-2016-9137

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curlfile.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during wakeup processing...

Internet Bug Bounty: stack-buffer-overflow through "ResourceBundle" methods

Upstream Bug --- https://bugs.php.net/bug.php?id=73218 Summary -- ResourceBundle::create and ResourceBundle::getLocales methods and their respective functions are vulnerables to stack buffer overflow when bundlename parameter length is equal or close to 0x7fffffff, due to a type confusion in...

Internet Bug Bounty: memcpy negative size parameter in php_resolve_path

Upstream Bug --- https://bugs.php.net/bug.php?id=73189 Summary -- Multiple PHP functions are vulnerable to negative size parameter in memcpy call through phpresolvepath. Some of the affected functions are: filegetcontents, fileputcontents, file, readfile, getmetatags, gzopen, readgzfile, gzfile,...

Internet Bug Bounty: Write out-of-bounds at number_format

Upstream Bug --- https://bugs.php.net/bug.php?id=73240 Summary -- When the numberformat function receives decimals parameter and decpoint length parameter equal or close to 0x7fffffff, integer overflow occurs in reslen variable, this causes a write heap overflow. USEZENDALLOC=0...