Amazon Linux AMI : php54 (ALAS-2016-670)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language XSL transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT...

php: SOAP serialize_function_call() type confusion

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

php: Use After Free Vulnerability in unserialize()

A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize function could cause a PHP application to crash or, possibly, execute arbitrary code...

Multiple vulnerabilities in extension "Fe user statistic" (festat)

It has been discovered that the extension "Fe user statistic" festat is susceptible to Cross-Site Scripting, Insecure Unserialize and Information Disclosure. Release Date: March 03, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affecte...

DOKEOS SSO Authentication Bypass Vulnerability

Dokeos is an open source online education and course management system. A security vulnerability exists in DOKEOS. The vulnerability is caused by a variable type obfuscation error when comparing passwords to unserializable strings during authentication, SSO authentication is not possible...

Internet Bug Bounty: Use-after-free vulnerability in SPL(SplObjectStorage, unserialize)

https://bugs.php.net/bug.php?id=71313...

Internet Bug Bounty: Use-after-free vulnerability in SPL(ArrayObject, unserialize)

https://bugs.php.net/bug.php?id=71311...

CVE-2015-6832

Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/splarray.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field...

CVE-2015-6832

CVE-2015-6832 is a use-after-free vulnerability in the SPL unserialize path (ext/spl/spl_array.c) of PHP. A crafted serialized payload can trigger misuse of an array field, allowing remote attackers to execute arbitrary code. Affected PHP versions: before 5.4.44, 5.5.x before 5.5.28, and 5.6.x be...

SSO Authentication Bypass and Website Takeover in DOKEOS

High-Tech Bridge Security Research Lab discovered a high-risk vulnerability in a popular e-learning software DOKEOS. A remote unauthenticated attacker can bypass authentication process and login to the vulnerable website with an arbitrary account including administrator's one. Successful...

Joomla 3.4.6 版本 unserialize 使用不当导致的代码执行

No description provided by source...

PHP process_nested_data 函数释放后重用漏洞

A while ago the function "processnesteddata" was changed to better handle object properties. Before it was possible to create numeric object properties which would cause trouble down the road. So the following code was added: if !objprops ... else / object properties should include no integers /...

Immunity Canvas: JOOMLA_SESSION_UNSERIALIZE

Name| joomlasessionunserialize ---|--- CVE| CVE-2015-8562 Exploit Pack| CANVAS Description| Joomla session unserialize 1.5 to 3.4.5 Notes| Repeatability: Infinite VENDOR: Joomla CVE Url: https://vulners.com/cve/CVE-2015-8562 CVE Name: CVE-2015-8562...

IBM WebSphere Application Server RCE Vulnerability (Nov 2015) - Version Check

IBM WebSphere Application Server is prone to a remote code execution RCE vulnerability in Apache Commons Collections. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

vBulletin 5.1.2 Unserialize Code Execution

This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.1.2 Unserialize Code Execution', 'Description' ...

Apache Commons Collections Unserialize Java Vulnerability

For close to 10 months, a critical vulnerability in a library found in most Java rollouts has been twisting in the wind, unpatched, and until this week without proof-of-concept exploits that people paid attention to. Two researchers with NTT Com Security changed that dynamic last week when they...

[SECURITY] [DLA 341-1] php5 security update

Package : php5 Version : 5.3.3.1-7+squeeze28 CVE ID : CVE-2015-6831 CVE-2015-6832 CVE-2015-6833 CVE-2015-6834 CVE-2015-6836 CVE-2015-6837 CVE-2015-6838 CVE-2015-7803 CVE-2015-7804 CVE-2015-6831 Use after free vulnerability was found in unserialize function. We can create ZVAL and free it via...

vBulletin 5.x.x 远程任意代码执行漏洞

unserialize 实战之 vBulletin 5.x.x 远程代码执行 --- Author: RickGray 知道创宇404安全实验室 近日，vBulletin 的一枚 RCE 利用和简要的分析被曝光，产生漏洞的原因源于 vBulletin 程序在处理 Ajax API 调用的时候，使用 unserialize 对传递的参数值进行了反序列化操作，导致攻击者使用精心构造出的 Payload 直接导致代码执行。关于 PHP 中反序列化漏洞的问题可以参考 OWASP 的《PHP Object Injection》。 使用 原文 提供的 Payload 可以直接在受影响的站点上执行...

PHP yaml_parse_url Double Free Vulnerability

The yaml parsing functions suffers from an exploitable double free caused by the error path for the phpvarunserialize call on line 797 of pecl/fileformats/yaml.git/parse.c. Title: PHP yamlparseurl Double Free Credit: John Leitch email protected Url1:...

SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)

This update of PHP5 brings several security fixes. Security fixes : - CVE-2015-6831: A use after free vulnerability in unserialize has been fixed which could be used to crash php or potentially execute code. bnc942291 bnc942294 bnc942295 - CVE-2015-6836: A SOAP serializefunctioncall type confusio...