PHP 4.x/5.0 Shared Memory Module Offset Memory Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12045/info PHP shared memory module shmop is reported prone to an integer handling vulnerability. The issue exists in the PHPFUNCTIONshmopwrite function and is as a result of a lack of sufficient sanitization performed on...

USN-2254-2: PHP updates

USN-2254-1 fixed vulnerabilities in PHP. The fix for CVE-2014-0185 further restricted the permissions on the PHP FastCGI Process Manager FPM UNIX socket. This update grants socket access to the www-data user and group so installations and documentation relying on the previous socket permissions...

SOL15316 - PHP vulnerability CVE-2013-4635

Recommended action None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents. SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5 critical issue...

EUVD-2014-0275

The cdfunpacksummaryinfo function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service performance degradation by triggering many fileprintf calls...

UBUNTU-CVE-2014-0238

The cdfreadpropertyinfo function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service infinite loop or out-of-bounds memory access via a vector that 1 has zero length or 2 is too long...

Remote file inclusion

PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter...

SOL15169 - PHP vulnerability CVE-2013-4113

Recommended Action If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists. To mitigate this...

Mandriva Linux Security Advisory : php (MDVSA-2014:075)

A vulnerability has been discovered and corrected in php : The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service CPU consumption...

Horde Framework - Unserialize PHP Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Horde Framework Unserialize PHP Code Execution', 'Description' = %q This module exploits a php unserialize vulnerability in Horde...

Malware Attacks Against Linux 2.6 Websites

The risks presented by unsupported operating systems are being called out in a large-scale attack on hundreds of websites. Hackers have hit web servers running a version of the Linux 2.6 kernel released seven years ago. The result is a multistage attack where compromised websites are spiked with...

CVE-2014-2020

ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain sensitive information by using a 1 string or 2 array data type in place of a numeric data type, as demonstrated by an imagecrop function call with a string for the x dimension value, a...

CVE-2013-7328

Multiple integer signedness errors in the gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 allow remote attackers to cause a denial of service application crash or obtain sensitive information via an imagecrop function call with a negative value for the 1 x or 2 y dimension, a...

WordPress Theme Dandelion - Arbitrary File Upload

Exploit Title: Wordpress Dandelion Themes Arbitry File Upload Google Dork: inurl:/wp-content/themes/dandelion/ Date: 31/01/2014 Exploit Author: TheBlackMonster Marouane Vendor Homepage: http://themeforest.net/item/dandelion-powerful-elegant-wordpress-theme/136628 Software Link: Not Available...

Coders code audit: php-vulnerability-vulnerability warning-the black bar safety net

In party company to do the code audit generally or in white-box based, vulnerability is nothing more than so few classes, XSS, asql injection, the command execution, upload vulnerability, local included, remote included, permissions, bypass, information disclosure, etc. 1. xss + sql injection...

php: memory corruption in openssl_x509_parse()

The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service memory...

php: memory corruption in openssl_x509_parse()

The asn1timetotimet function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse 1 notBefore and 2 notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service memory...

EUVD-2013-6514

The scan function in ext/date/lib/parseisointervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, which might allow remote attackers to cause a denial of service heap-based buffer over-read via a crafted interval specification...

ZonPHP 2.25 - Remote Code Execution

ZonPHP 2.25 - Remote Code Execution Exploit Title: ZonPHP V2.25 RCE Vulnerability Google Dork: intext:"Made by SLAPER" Date: 21-10-2013 Exploit Author: Halim Cruzito Vendor Homepage: http://www.slaper.be Software Link: http://www.slaper.be/zonPHPv225.zip Version: v2.25 Tested on: Windows 7 PoC: "...

Moodle 2.5.0-1 (badges/external.php) PHP Object Injection Vulnerability

============================================= - Original release date: 15 September, 2013 - Discovered by: Emilio Pinna Application Security Analyst at Abinsula - Contact: emilio pinn gmail ============================================= VULNERABILITY ---------------------- Moodle CMS version 2.5.0...

PHP: sapi_header_op() %0D sequence handling security bypass

The sapiheaderop function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences aka carriage return characters, which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction betwe...