ANT-2026-KP4YD2Z6 · php/php-src · Memory Corruption / Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-KP4YD2Z6: DBA flatfile length parsing triggers heap...

WS-2019-0385

In php-src, “ext/exif/exif.c” php-4.0.1RC to php-7.4.0beta2 are vulnerable to DOS attack due to lack of appropriate handling of error messages...

WS-2019-0384

In php-src, php-4.0RC1 to php-7.3.11RC1 it’s possible to exceed the heap boundaries due to lack of pointer's position validation, thus allowing a potential attacker to read sensitive data...

CVE-2018-10549

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. exifreaddata in ext/exif/exif.c has an out-of-bounds read for crafted JPEG data because exifiifaddvalue mishandles the case of a MakerNote that lacks a final '\0' character...

WS-2017-3756

In php-src, php-4.3.0RC1 to 7.2.0beta3, the “imagecreatefromstring” PHP function is vulnerable to a denial of service, and potentially to an information disclosure vulnerability, due to mishandling of the bmp images data start offset...

WS-2016-7089

In php-src, php-5.6.0RC1 to php-7.1.0beta3 are vulnerable to buffer overflow due to the use of an integer variable over “sizet” that leads to the loss of integrity and can damage the availability as well...

WS-2016-7090

In php-src, ”ftpfopenwrapper.c”, php-4.3.0pre1 to php-7.0.10RC1 are vulnerable to protocol downgrade attack, due to using a non-secured version of the FTP protocol...

WS-2016-7091

In php-src, PHP-5.4.1-RC1 to php-7.0.8, the “psfilescleanupdir“ function is vulnerable against a Buffer overflow vulnerability via the “dirname” variable. This issue may be used to crash the program, and allow Remote code execution...

WS-2015-0065

In php-src, php-5.3.0RC1 to php-5.6.11RC1, there is “use-after-free” vulnerability related to the PHP methods “lasterrorcode” and “lasterrormessage”. Using an invalid SQL query, an attacker may leverage the vulnerability in order to crash the program, and potentially allow a RCE...

WS-2013-0240

In php-src, php-5.0.0b2 to php-5.4.12, have a flaw in the TLS compression, that can lead to recovery of secret authentication cookies and allows an attacker to perform session hijacking on an authenticated web session...

WS-2012-0020

In php-src, php-5.1.2RC1 to php-5.4.8 there is a buffer overflow vulnerability. “discardstate” array is 5 chars long although the buffer must be 6 chars long in order to include null char terminator...

WS-2012-0021

In php-src, PHP-5.4.1-RC1 to PHP5215RC1, there is a Buffer overflow vulnerability exists in “phphtmlentities” function which may be triggered by a large input to the “htmlspecialchars” PHP function. This may lead to a denial of service, and even allow remote code execution...

WS-2012-0019

In php-src, php-5.3.1RC1 to php-5.4.0beta2 there is a vulnerability which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack BCBA on an HTTPS session, in conjunction with JavaScript code that uses 1 the HTML5 WebSocket API 2 the Java...

PT-2010-4530

Name of the Vulnerable Software and Affected Versions smbind versions prior to 0.4.8 Description The issue concerns a problem with the filter function in the smbind software, specifically in the php/src/include.php file. This problem allows remote attackers to conduct SQL injection attacks by...

CVE-2010-3076: Improper Neutralization of Special Elements used in an SQL Command

The filter function in php/src/include.php in Simple Management for BIND aka smbind before 0.4.8 does not anchor a certain regular expression, which allows remote attackers to conduct SQL injection attacks and execute arbitrary SQL commands via the username parameter to the admin login page...