CVE-2016-9138

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during wakeup processing, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data, as demonstrated by Exception::toString with DateInterval::wakeup...

Internet Bug Bounty: Use-after-free in ArrayObject Deserialization

The bug report at: https://bugs.php.net/bug.php?id=73144 The fix commit at: https://github.com/php/php-src/commit/f74d7d92c8bc1edc2505e0b58546217e9e1ecb40...

Internet Bug Bounty: Invalid memory access in spl_filesystem_dir_open function

https://bugs.php.net/bug.php?id=73316...

Internet Bug Bounty: Memory corruption due to missing check size in _php_math_number_format_ex()

The fix for this bug has been committed: https://bugs.php.net/bug.php?id=73424 Description: ------------ I have found some vulnerable code at phpmathnumberformatex function. phpmathnumberformatex function is an internal function which is called from numberformat function. numberformat function...

Internet Bug Bounty: Heap overflow due to integer overflow in bzdecompress() function

The fix for this bug has been committed: https://bugs.php.net/bug.php?id=73386 Description: ------------ I have found some vulnerable code at bzdecompress function in module Bzip2. bzdecompress function creates a new zendstring object to store decompressed data. The size of destination string...

Internet Bug Bounty: crash in get_icu_value_internal function

https://bugs.php.net/bug.php?id=73378...

Internet Bug Bounty: crash in gzcompress and 3 other compress functions

https://bugs.php.net/bug.php?id=73357...

Internet Bug Bounty: CachingIterator null dereference when convert to string

https://bugs.php.net/bug.php?id=73073 Please feel free to ask for more technical details if necessary. Thank you for your consideration...

Internet Bug Bounty: Stack Buffer Overflow in GD dynamicGetbuf

Stack-based buffer over flow in GD dynamicGetbuf - Vulnerable function: imagecreatefromstring - Bug has been reported: https://bugs.php.net/bug.php?id=73280 - Submitted a patch and accepted: https://github.com/php/php-src/commit/cc08cbc84d46933c1e9e0149633f1ed5d19e45e9 - Impact: Remotely...

Internet Bug Bounty: ldap_escape could produce string larger than 2Gb

https://bugs.php.net/bug.php?id=72975...

Internet Bug Bounty: integer overflow in fgetcsv caused heap corruption

Please check: https://bugs.php.net/bug.php?id=73045...

Internet Bug Bounty: integer overflow in fgets cause heap corruption

Please check: https://bugs.php.net/bug.php?id=73011...

Internet Bug Bounty: integer overflow in preg_quote caused heap corruption

Please check: https://bugs.php.net/bug.php?id=72895...

Internet Bug Bounty: integer overflow in pg_escape_string caused heap corruption

https://bugs.php.net/bug.php?id=72874...

Internet Bug Bounty: Out of bound when verify signature of tar phar in phar_parse_tarfile

https://bugs.php.net/bug.php?id=73035 There was a security code in pharparsetarfile if FAILURE == pharverifysignaturefp, phpstreamtellfp - size - 512, myphar-sigflags, buf + 8, size - 8, fname, &myphar-signature, &myphar-siglen, error if error char save = error; spprintferror, 4096, "phar error:...

SugarCRM REST Unserialize PHP Code Execution

This module exploits a PHP Object Injection vulnerability in SugarCRM CE 'SugarCRM REST Unserialize PHP Code Execution', 'Description' = %q This module exploits a PHP Object Injection vulnerability in SugarCRM CE 'EgiX', 'License' = MSFLICENSE, 'References' = 'URL', 'http...

Internet Bug Bounty: imagegammacorrect allows arbitrary write access

Upstream Bug --- 2016-08-02 03:46 UTC https://bugs.php.net/bug.php?id=72730 Summary -- imagegammacorrect accepts two gamma values, if they don't have the same sign then the palette colors will be assigned values bigger than 0xFF, later this values are used to calculate the transparent color using...

Internet Bug Bounty: Memory Leakage In exif_process_IFD_in_TIFF (CVE-2016-7128)

I found some vulnerable code that leads to the memory leak in exifprocessIFDinTIFF. Let take look at code chunk : if !ImageInfo-Thumbnail.data && ImageInfo-Thumbnail.offset && ImageInfo-Thumbnail.size && ImageInfo-readthumbnail ImageInfo-Thumbnail.data = safeemallocImageInfo-Thumbnail.size, 1, 0;...

Internet Bug Bounty: integer overflow in quoted_printable_encode caused heap corruption

Please check: https://bugs.php.net/bug.php?id=72848...

Internet Bug Bounty: Integer overflow lead to heap corruption in sql_regcase

Please check: https://bugs.php.net/bug.php?id=72838...