PHP <= 4.4.3 / 5.1.4 (objIndex) Local Buffer Overflow Exploit PoC

No description provided by source. ?php / Author: Heintz Date: 4-th august 2006 Greets: Waraxe from www.waraxe.us All buds at www.plain-text.info Torufoorum ext/standard/scanf.c line 887 --- if numVars current = argsobjIndex++; --- objIndex points past the end of array in other format cases too...

security flaw

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read...

Moderate: Red Hat Security Advisory: php security update

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server....

USN-342-1: PHP vulnerabilities

The sscanf function did not properly check array boundaries. In applications which use sscanf with argument swapping, a remote attacker could potentially exploit this to crash the affected web application or even execute arbitrary code with the application's privileges. CVE-2006-4020 The fileexis...

GLSA-200608-28 : PHP: Arbitary code execution

The remote host is affected by the vulnerability described in GLSA-200608-28 PHP: Arbitary code execution The sscanf PHP function contains an array boundary error that can be exploited to dereference a NULL pointer. This can possibly allow the bypass of the safe mode protection by executing...

PHP: Arbitary code execution

Background PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. Description The sscanf PHP function contains an array boundary error that can be exploited to dereference a null pointer. This can possibly allow the...

php -- multiple vulnerabilities

The PHP development team reports: Added missing safemode/openbasedir checks inside the errorlog, fileexists, imapopen and imapreopen functions. Fixed overflows inside strrepeat and wordwrap functions on 64bit systems. Fixed possible openbasedir/safemode bypass in cURL extension and with realpath...

PHP <= 4.4.3 / 5.1.4 (sscanf) Local Buffer Overflow Exploit

No description provided by source. ? / hoagiephpsscanf.php PHP = 4.4.3 / 5.1.4 local buffer overflow exploit howto get offsets: set $baseaddr to 0x41414141 ulimit -c 20000 /etc/init.d/apache restart execute script via web browser tail /var/log/apache/error.log ... Wed Aug 16 15:07:10 2006 notice...

CVE-2006-4020

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read...

CVE-2006-4020

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read...

CVE-2006-4020

CVE-2006-4020 affects PHP when using the sscanf function. In PHP 5.1.4 and earlier (and 4.4.3 and earlier), a context-dependent attacker can cause a buffer over-read by argument swapping in sscanf, potentially enabling arbitrary code execution. Vendor advisories and OpenVAS/Nessus entries indicat...

php local buffer underflow could lead to arbitary code execution

Affected versions: php 5.1.4 and older, 4.4.3 and possibly older Cause: when php-s sscanf functions format argument contains argument swap and extra arguments are given like. sscanf'foo ','$1s',$bar then it reads an pointer to pointer to zval structure past the end of argument array by one. Php...

PHP memory corruption

sscanf function past the end of aray writing...

PHP 4.4.35.1.4 - objIndex Local Buffer Overflow

PHP 4.4.35.1.4 - objIndex Local Buffer Overflow ?php / Author: Heintz Date: 4-th august 2006 Greets: Waraxe from www.waraxe.us All buds at www.plain-text.info Torufoorum ext/standard/scanf.c line 887 --- if numVars current = argsobjIndex++; --- objIndex points past the end of array in other forma...

CVE-2006-4020: Undefined Security Weakness

scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read...

PT-2006-4865 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions 4.4.3 and earlier PHP versions 5.1.4 and earlier Description: The issue allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping. This can trigger a buffer...

FreeBSD : elm -- remote buffer overflow in Expires header (f66e011d-13ff-11da-af41-0004614cc33d)

Ulf Harnhammar has discovered a remotely exploitable buffer overflow in Elm e-mail client when parsing the Expires header of an e-mail message : The attacker only needs to send the victim an e-mail message. When the victim with that message in his or her inbox starts Elm or simply views the inbox...

CVE-2005-4676: Undefined Security Weakness

Buffer overflow in Andreas Huggel Exiv2 before 0.9 does not null terminate strings before calling the sscanf function, which allows remote attackers to cause a denial of service application crash via images with crafted IPTC metadata...

exiv2 IPTC library DoS

sscanf is used for data wich is not NULL-terminated...

elm -- remote buffer overflow in Expires header

Ulf Harnhammar has discovered a remotely exploitable buffer overflow in Elm e-mail client when parsing the Expires header of an e-mail message: The attacker only needs to send the victim an e-mail message. When the victim with that message in his or her inbox starts Elm or simply views the inbox ...