SUSE CVE-2014-3515

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, relate...

PHP interpreter vulnerabilities that allow attackers to execute arbitrary code

The multiple vulnerabilities of the PHP SPL interpreter library are related to the use of memory after it is freed. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code using classes like ArrayObject, SplObjectStorage, and SplDoublyLinkedList...

CVE-2011-0754

The SplFileInfo::getType function in the Standard PHP Library SPL extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat structure, related to lack...