Buffer overflow

Buffer overflow in the phpstreamfiltercreate function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service application crash via a php://filter/ URL that has a name ending in the '.' character...

CVE-2007-1824

Buffer overflow in the phpstreamfiltercreate function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service application crash via a php://filter/ URL that has a name ending in the '.' character...

CVE-2007-1825

CVE-2007-1825: Buffer overflow in PHP imap_mail_compose (PHP 5 < 5.2.1; PHP 4

CVE-2007-1824

CVE-2007-1824 affects PHP 5 prior to 5.2.1. The vulnerability is a buffer overflow in php_stream_filter_create that can be triggered by a php://filter/ URL whose name ends with a dot, allowing remote attackers to cause a denial of service (application crash). Remote exploitation is described in t...

CVE-2007-1824

Buffer overflow in the phpstreamfiltercreate function in PHP 5 before 5.2.1 allows remote attackers to cause a denial of service application crash via a php://filter/ URL that has a name ending in the '.' character...

aardvark-rfi.txt

By Hasadya Raed Contact : [email protected] Israel ---------------------------------------- Script : Aardvark Topsites PHP 5 Dork : "Copyright c 2003-2005 Jeremy Scheff. All rights reserved" --------------------------------------- B.Files : settingssql.php newday.php...

MOPB-34-2007:PHP mail() Header Injection Through Subject and To Parameters

Summary The mail function converts control characters like linefeed or carriage return in the Subject and To parameters into spaces as a protection against email header injection. However an exception is made for folded mail headers that continue on the next line. Unfortunately the macro handling...

MOPB-33-2007:PHP mail() Message ASCIIZ Byte Truncation

Summary When the mail function is called with a message that contains an ASCIIZ byte it considers it the end of the message. PHP applications not filtering ASCIIZ strings from user input before embedding it into the message are therefore vulnerable to arbitrary email truncation. Affected versions...

PHP 5.2.1 - Multiple functions 'Reference' Information Disclosures

source: https://www.securityfocus.com/bid/23202/info PHP is prone to an information-disclosure vulnerability due to a design error. The vulnerability resides in various functions that accept parameters as references. Successful exploits will allow attackers to obtain sensitive information...

MOPB-26-2007:PHP mb_parse_str() register_globals Activation Vulnerability

Summary When the mbparsestr function, which is the multibyte variant of the parsestr function, is called with only one parameter and is interrupted by for example a memorylimit violation the registerglobals directive will get internally activated during the process and not deactivated. Therefore...

MOPB-22-2007:PHP session_regenerate_id() Double Free Vulnerability

Summary The sessionregenerateid function that is used to generate a new session identifier fails to clear an already freed pointer to the former session identifier before calling the session identifier generator. When this generator triggers an error this can result in a double free that is easil...

Buffer overflow

The wddxdeserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code via a WDDX packet wit...

CVE-2007-1381

The wddxdeserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code via a WDDX packet wit...

CVE-2007-1381

CVE-2007-1381 affects PHP 5, where wddx_deserialize in wddx.c (versions 1.119.2.10.2.12/1.119.2.10.2.13) uses incorrect arguments to strlcat, calling strlcpy instead and enabling a buffer overflow via a malformed WDDX STRING overlap. It was modified in CVS on 20070224 and fixed on 20070304. Affec...

MOPB-14-2007:PHP substr_compare() Information Leak Vulnerability

Summary PHP 5 comes with the substrcompare function that allows binary safe, optionally case insensitive, comparison of 2 strings from an offset, up to length characters. Due to an integer overflow while performing sanity checks on the arguments it is possible to compare offsets far outside the...

CVE-2007-1381

The wddxdeserialize function in wddx.c 1.119.2.10.2.12 and 1.119.2.10.2.13 in PHP 5, as modified in CVS on 20070224 and fixed on 20070304, calls strlcpy where strlcat was intended and uses improper arguments, which allows context-dependent attackers to execute arbitrary code via a WDDX packet wit...

Design/Logic Flaw

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service stack exhaustion and PHP crash via deeply nested arrays, which trigger deep recursion in the variable destruction routines...

CVE-2007-1285

The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service stack exhaustion and PHP crash via deeply nested arrays, which trigger deep recursion in the variable destruction routines...

CVE-2007-0988

The zendhashinit function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attackers to cause a denial of service infinite loop by unserializing certain integer expressions, which only cause 32-bit arguments to be used after the check for a...

Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion

Title: Jupiter CMS 1.1.5 Multiple Vulnerabilities Advisory ID: 12070214 Risk level: High Author: DarkFig URL: http://www.acid-root.new.fr/advisories/12070214.txt Risk level: High Summary: Local/Remote File Inclusion Conditions: LFI: magicquotesgpc = Off RFI: PHP = 5.0.0, allowurlfopen = On The...