CVE-2016-3132

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index...

Double free

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index...

CVE-2016-3132

CVE-2016-3132: A double free vulnerability in PHP’s SplDoublyLinkedList::offsetSet (ext/spl/spl_dllist.c) affects PHP 7.x prior to 7.0.6. Exploitation via a crafted index allows remote code execution. The affected software is PHP 7.x before 7.0.6; the root cause is the double free in the offsetSe...

CVE-2016-5768

Double free vulnerability in the phpmbregexeregreplaceexec function in phpmbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service application crash by leveraging a callback...

CVE-2015-8880

Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error...

Double free

Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error...

CVE-2015-8880

CVE-2015-8880 is a PHP vulnerability described as a double free in the format printer that affects PHP 7.x up to but not including 7.0.1. The NVD entry specifies that remote attackers could trigger an error and cause an unspecified impact. The connected OpenVAS entries corroborate the same CVE an...

CVE-2015-8880

Removed by vendor...

Code injection

The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the pharanalyzepath function in ext/phar/phar.c...

Safety warning: PHP zip component integer overflow remote command execution-vulnerability warning-the black bar safety net

A, detailed description: In PHP 7 is due. x versions, which php Vulnerability report at 3. 2 9 has been submitted to the vulnerability to official ! 4. 2 8, official released 7. 0. 6 version fixes the vulnerability, while the author in github released the exp ! Second, the problem of proof: !...

CVE-2016-3132

Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spldllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index...

Internet Bug Bounty: xml_parse_into_struct segmentation fault

https://bugs.php.net/bug.php?id=72099 Invalid memory access while parsing XML input using xmlparseintostruct, parser-level wasn't being checked and then used as an offset parser-ltagsparser-level-1. Reported to developers on 2016-04-25, fixed 2016-04-25 and released at 2016-04-28, affected PHP 5....

Internet Bug Bounty: Out-of-bounds reads in zif_grapheme_stripos with negative offset

https://bugs.php.net/bug.php?id=72061 graphemestripos from the intl extension had a security issue when handling negative offsets, this allowed to read from arbitrary memory locations. Reported to developers on 2016-04-24, fixed 2016-04-29 and released at 2016-04-28, affected PHP 5.5 , 5.6 and 7...

The use of PHP 7 is due to the OPcache execute PHP code-bug warning-the black bar safety net

from:http://blog. gosecure. ca/2 0 1 6/0 4/2 7/binary-webshell-through-opcache-in-php-7/ In the PHP 7.0 release at the beginning, there are a lot of PHP developers for its performance improvement is very attention. In the introduction of OPcache, PHP performance has been greatly improved, many...

CVE-2016-4342

ext/phar/pharobject.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service heap memory corruption or possibly have unspecified other impact via a crafted 1 TAR, 2 ZIP, or 3 PHAR archive...

CVE-2016-1904

Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the 1 phpescapeshellcmd or 2 phpescapeshellarg function, leading to a heap-based buffer overflow...

CVE-2015-6527

The phpstrreplaceinsubject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the strireplace function...

CVE-2015-8617

Format string vulnerability in the zendthroworerror function in Zend/zendexecuteAPI.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling...

CVE-2015-8616

Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collatorsort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service application crash or possibly have unspecified other impact by leveraging the relationships between a key buffer...

Format string

Format string vulnerability in the zendthroworerror function in Zend/zendexecuteAPI.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling...