Xxe

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

CVE-2013-1635

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an...

CVE-2013-1643

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

CVE-2013-1635

CVE-2013-1635 affects PHP prior to 5.3.22 and 5.4.x prior to 5.4.13. The issue is that ext/soap/soap.c does not validate the relationship between soap.wsdl_cache_dir and open_basedir, enabling an attacker to cause SOAP WSDL cache files to be created in an arbitrary directory and bypass access res...

CVE-2013-1643

PHP SOAP parser vulnerability CVE-2013-1643 affects PHP before 5.3.23 and 5.4.x before 5.4.13, where a SOAP WSDL containing an XML external entity declaration combined with an entity reference allows remote attackers to read arbitrary files via soap_xmlParseFile/soap_xmlParseMemory. This is tied ...

CVE-2013-1643

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

CVE-2013-1635

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an...

PT-2013-1336

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.23 PHP versions 5.4.x prior to 5.4.13 Description The issue is related to an XML External Entity XXE problem in the soap xmlParseFile and soap xmlParseMemory functions, allowing remote attackers to read arbitrary file...

CVE-2013-1643: Exposure of Sensitive Information to an Unauthorized Actor

The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue in the soapxmlParseFile and...

CVE-2013-1635: Undefined Security Weakness

ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an...

PT-2013-1332

Name of the Vulnerable Software and Affected Versions PHP versions prior to 5.3.22 PHP versions 5.4.x prior to 5.4.13 Description The issue is related to errors in privilege management in the ext/soap/soap.c component of the PHP interpreter. It allows a remote attacker to elevate their privileges...

[SECURITY] [DSA 2639-1] php5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2639-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst March 05, 2013 http://www.debian.org/security/faq -...

DSA-2639-1 php5 - several vulnerabilities

Bulletin has no description...

Debian Security Advisory DSA 2639-1 (php5 - several vulnerabilities)

Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2013-1635 If a PHP application accepted untrusted SOAP object input remotely from clients, an attacker could read system files...

PHP 5.4.x < 5.4.12 Multiple Vulnerabilities

Binary data 6708.prm...

PHP 5.3.x < 5.3.22 Multiple Vulnerabilities

Binary data 6707.prm...

php5 -- Multiple vulnerabilities

The PHP development team reports: PHP does not validate the relationship between the soap.wsdlcachedir directive and the openbasedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory. The...

PHP 5.3.x < 5.3.22 Multiple Vulnerabilities

According to its banner, the version of PHP 5.3.x installed on the remote host is prior to 5.3.22. It is, therefore, potentially affected by the following vulnerabilities : - An error exists in the file 'ext/soap/soap.c' related to the 'soap.wsdlcachedir' configuration directive and writing cache...

PHP 5.4.x < 5.4.12 Information Disclosure

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.12. It is, therefore, potentially affected by an information disclosure in the file 'ext/soap/phpxml.c' related to parsing SOAP 'wsdl' files and external entities that could cause PHP to parse remote XM...

Adobe InDesign Server SOAP Request Lack of Authentication

Access control weakness vulnerability exists in Adobe InDesign Server.The vulnerability is due to a failure to restrict access to the SOAP interface.Successful exploitation could result in execution of arbitrary script code in the context of the service...