CVE-2016-3718

ImageMagick is affected by CVE-2016-3718: the HTTP and FTP coders can be abused to perform server-side request forgery via a crafted image. Affected lines: ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1. The vulnerability allows an attacker to induce the server to make HTTP/FTP requests when ...

CVE-2016-3715

Summary: CVE-2016-3715 affects ImageMagick where the EPHEMERAL coder allows a remote attacker to delete arbitrary files via a crafted image. Affected versions are ImageMagick prior to 6.9.3-10 and 7.x prior to 7.0.1-1. Impact (per sources): Remote deletion of files via crafted images using the EP...

CVE-2016-2107

CVE-2016-2107 (OpenSSL) is a padding-oracle vulnerability in the AES-NI CBC MAC check. The issue arises in the AES-CBC padding validation where memory allocation during the padding check is mishandled, enabling potential leakage of plaintext under certain conditions. Affected OpenSSL versions inc...

CVE-2015-4599

CVE-2015-4599 affects PHP’s SoapFault::__toString in ext/soap/soap.c. The issue arises from a type confusion when processing unexpected data types, enabling remote attackers to obtain sensitive information, trigger a denial of service (application crash), or possibly execute arbitrary code. Affec...

CVE-2016-2108

CVE-2016-2108 : OpenSSL’s ASN.1 implementation allows remote attackers to execute arbitrary code or cause a denial of service via a crafted ASN.1 ANY field, due to a buffer underflow/memory corruption when deserializing data. Affected: OpenSSL versions prior to 1.0.1o (and prior to 1.0.2c in the ...

CVE-2015-5312

Summary (CVE-2015-5312) A DoS via XML entity expansion was reported in libxml2 (xmlStringLenDecodeEntities in parser.c) affecting versions before 2.9.3. The issue allows a context-dependent attacker to trigger high CPU usage by processing crafted XML data, as described in the CVE entry and corrob...

CVE-2015-4603

CVE-2015-4603 centers on PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8. The exception::getTraceAsString function in Zend/zend_exceptions.c allows remote code execution via a type confusion in an unexpected data type. Affected PHP versions and explicit fixes are noted in the descr...

CVE-2015-4602

CVE-2015-4602 affects PHP via the __PHP_Incomplete_Class function in ext/standard/incomplete_class.c. Affected PHP branches are 5.4.x before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8. The vulnerability arises from a type confusion in handling unexpected data types, enabling remote attac...

CVE-2016-4455

CVE-2016-4455 affects the Subscription Manager (subscription-manager) before 1.17.7-1 for Candlepin. The weakness is weak permissions (755) on subscription-manager cache directories, enabling local users to read files and obtain sensitive information. The connected documents corroborate the affec...

CVE-2015-4600

CVE-2015-4600 affects PHP SoapClient: vulnerable in PHP versions prior to 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8. Root cause is a type confusion in SoapClient methods (getLastRequest/Response, getLastRequestHeaders/ResponseHeaders, getCookies, setCookie). Impact per the description: ...

CVE-2012-6662

CVE-2012-6662 is a cross-site scripting (XSS) vulnerability in the default content option of jquery.ui.tooltip.js (Tooltip widget) in jQuery UI before 1.10.0. The issue allows remote attackers to inject arbitrary script/HTML via the title attribute, exploitable through the autocomplete combo box ...

CVE-2016-3716

CVE-2016-3716 affects ImageMagick (MSL coder) and allowed a remote attacker to move uploaded files by processing a crafted image. Affected products include ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1. Multiple coordinated advisories describe ImageTragick issues caused by lack of input sani...

CVE-2016-5388

The CVE-2016-5388 issue affects Apache Tomcat (CGI Servlet enabled) where Proxy header handling exposes HTTP_PROXY data to CGI scripts, enabling redirection of outbound requests to a attacker-controlled proxy (httpoxy). Public advisories across multiple distributions confirm Tomcat 7.x up to 7.0....

CVE-2015-2787

The CVE-2015-2787 entry describes a use-after-free in PHP’s unserialize path (process_nested_data in ext/standard/var_unserializer.re) that allows remote code execution via crafted unserialize input. Affected versions are PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7; remediation...

CVE-2016-2109

CVE-2016-2109 is a denial-of-service in OpenSSL: memory exhaustion caused by a short, invalid ASN.1 encoding read via BIO in the asn1_d2i_read_bio path. Affected are OpenSSL builds before 1.0.1t and 1.0.2 before 1.0.2h. Remediation is to upgrade to OpenSSL 1.0.1t or 1.0.2h (or later). This is sup...

CVE-2015-2348

CVE-2015-2348 affects PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7, where move_uploaded_file truncates a pathname at the first null byte (\x00). This allows remote attackers to bypass extension restrictions and create files with unexpected names via a crafted second argument. Th...

CVE-2015-7547

CVE-2015-7547 refers to a stack-based buffer overflow in the GLIBC libresolv DNS resolver path, triggered by dual A/AAAA DNS queries in getaddrinfo. The vulnerability could allow remote code execution or crash the process when handling crafted DNS responses, with exploitation possible via the nss...

CVE-2016-0758

CVE-2016-0758 concerns an integer overflow in the Linux kernel’s ASN.1 DER decoder (lib/asn1_decoder.c) that could allow local privilege escalation. The Android 2016-10-05 bulletin documents this as a kernel ASN.1 decoder elevation-of-privilege issue with Critical severity, affecting Nexus device...

CVE-2015-2301

Summary of CVE-2015-2301 Affected software: PHP before 5.5.22 and 5.6.x before 5.6.6 (phar extension). Root cause: Use-after-free in phar_rename_archive function within phar_object.c. Impact: Remote attackers may cause a denial of service or potentially other unspecified effects by triggering an ...

CVE-2015-3329

CVE-2015-3329 describes multiple stack-based buffer overflows in PHP’s Phar handling (phar_set_inode in phar_internal.h) that allow remote code execution via crafted length values in tar, phar, or ZIP archives. Affected PHP releases are 5.4.40 and earlier (5.4.x), 5.5.x prior to 5.5.24, and 5.6.x...

CVE-2016-2105

CVE-2016-2105 concerns OpenSSL: an overflow in EVP_EncodeUpdate can cause a heap memory corruption and denial of service when processing large amounts of data. The connected OpenSSL advisories confirm the vulnerability and cite fixes for versions 1.0.1t and 1.0.2h (backported fixes for earlier 0....

CVE-2016-7545

CVE-2016-7545 affects SELinux policycoreutils where the sandbox tool is vulnerable to a TIOCSTI ioctl attack, allowing local users to execute arbitrary commands outside the sandbox. The issue is documented by several advisories and vendor bulletins (e.g., Red Hat RHSA-2016:2702, CentOS CESA-2016:...

CVE-2015-3307

CVE-2015-3307 affects PHP’s Phar extension (phar.c: ext/phar/phar.c) in PHP releases earlier than 5.4.40, 5.5.x earlier than 5.5.24, and 5.6.x earlier than 5.6.8. A crafted tar archive can trigger the phar_parse_metadata path to cause a denial of service via heap metadata corruption, and may have...

CVE-2015-4024

The CVE-2015-4024 entry describes an algorithmic complexity DoS in PHP’s multipart HTTP POST handling (multipart_buffer_headers in main/rfc1867.c). Attackers can cause high CPU usage with specially crafted form data, affecting PHP versions prior to 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5....

CVE-2016-2106

CVE-2016-2106 affects OpenSSL: an integer overflow in EVP_EncryptUpdate can overflow a heap buffer when processing very large inputs, enabling remote denial of service or crash. Affected versions include OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h; mitigations in public advisories recommend upg...

CVE-2015-4026

The CVE-2015-4026 issue affects PHP prior to 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9. The pcntl_exec implementation truncates a pathname when it hits a null byte (\x00), which may allow remote attackers to bypass extension restrictions and execute files with unintended names via a cra...

CVE-2015-4025

CVE-2015-4025 affects PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9. It truncates a pathname when a NULL byte is encountered in certain calls (set_include_path, tempnam, rmdir, readlink), allowing bypass of extension restrictions and access to files/dirs with unexpected names. Th...

CVE-2016-0636

CVE-2016-0636 is corroborated by connected advisories tying it to OpenJDK/Hotspot sandbox escape issues. Affected packages include OpenJDK 7/8 (e.g., OpenJDK 7 in Debian upgrade paths and OpenJDK 8/OpenJDK 7 updates in various distros). Public details in the documents indicate a sandbox escape vu...

CVE-2015-4021

The CVE-2015-4021 vulnerability affects PHP’s phar_parse_tarfile (ext/phar/tar.c) in versions before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9. It does not verify that the first character of a filename differs from the NULL byte, allowing a crafted tar entry to trigger an integer underf...

CVE-2015-4601

CVE-2015-4600 and CVE-2015-4601 are PHP SOAP issues related to type confusion in the SOAP client/extension. The advisories describe: (1) CVE-2015-4600 affects SoapClient::__getLastRequest, __getLastResponse, __getLastRequestHeaders, __getLastResponseHeaders, __getCookies, and __setCookie; (2) CVE...

CVE-2015-4147

CVE-2015-4147 affects PHP’s SOAP extension. The vulnerability is in SoapClient::__call in ext/soap/soap.c where __default_headers is not verified to be an array, enabling a type confusion that allows remote code execution via crafted serialized data. Affected versions: PHP before 5.4.39, 5.5.x be...

CVE-2015-5300

CVE-2015-5300 (NTP panic-threshold bypass) is detailed in connected advisory from F5 for BIG-IP products, describing a vulnerability in ntpd where the threshold for the -g option is not correctly enforced. An attacker controlling NTP traffic could cause ntpd to step the clock to an arbitrary valu...

CVE-2015-4598

CVE-2015-4598 affects PHP prior to 5.4.42, 5.5.x prior to 5.5.26, and 5.6.x prior to 5.6.10. The issue arises because pathnames may contain a NULL byte (%00), which can allow a remote attacker to read or write arbitrary files when an application calls either a DOMDocument save method or the GD im...

CVE-2015-3411

The CVE-2015-3411 issue affects PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 where pathnames could include a NULL character (\0). This allows remote attackers to read or write arbitrary files via crafted input in calls such as DOMDocument::load, xmlwriter_open_uri, finfo_file, o...

CVE-2015-4022

CVE-2015-4022 specifies an Integer overflow in PHP’s ftp_genlist() (ext/ftp/ftp.c) that enables a remote FTP server to trigger a heap-based buffer overflow via a long LIST reply. Affected PHP versions are before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9. The vulnerability allows potenti...

CVE-2015-2783

Summary: CVE-2015-2783 affects PHP’s Phar handling. The Phar extension in PHP up to versions 5.4.39/5.5.23/5.6.7 (i.e., PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8) is vulnerable. A crafted length value combined with serialized data inside a Phar archive can allow a remote atta...

CVE-2015-3330

CVE-2015-3330 affects PHP when running under Apache httpd 2.4.x; the php_handler in sapi/apache2handler/sapi_apache2.c can be invoked by pipelined HTTP requests to cause a denial of service or possibly arbitrary code execution due to a deconfigured interpreter. Affected families are PHP versions ...

CVE-2015-5157

CVE-2015-5157 affects the Linux kernel prior to 4.1.6 on x86_64. The issue is in arch/x86/entry/entry_64.S where IRET faults during NMIs that occur in userspace are mishandled, potentially allowing a local user to gain privileges. The vulnerability is described in several connected advisories as ...

CVE-2015-4605

The vulnerability CVE-2015-4605 affects PHP’s Fileinfo component: the mcopy function in softmagic.c does not properly restrict a certain offset, enabling a crafted string (mishandled by a Python script text executable rule) to cause a denial of service or potentially arbitrary code execution. Aff...

CVE-2015-7981

CVE-2015-7981 affects libpng in multiple branches: 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17. The issue is an out-of-bounds read in png_convert_to_rfc1123 triggered by crafted tIME chunk data, enabling a remote attacker to disclose sensitive process memory information. The...

CVE-2016-3698

CVE-2016-3698 affects libndp prior to 1.6 used by NetworkManager; vulnerable code path validates the origin of Neighbor Discovery Protocol messages and can enable an attacker on a non‑local network to advertise a node as a router, enabling MITM or disrupting connectivity. Multiple vendors/distros...

CVE-2015-3412

CVE-2015-3412 affects PHP prior to 5.4.40, 5.5.x prior to 5.5.24, and 5.6.x prior to 5.6.8. The issue stems from not ensuring that pathnames lack %00 sequences when stream_resolve_include_path is used, enabling a filename\0.extension attack to bypass a restricted extension and read files. Public ...

CVE-2015-4148

CVE-2015-4148 affects PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7. The issue arises in do_soap_call() in ext/soap/soap.c where the uri property is not verified to be a string, enabling a remote attacker to obtain sensitive information by sending crafted serialized data with an ...

CVE-2015-5219

CVE-2015-5219 affects the Network Time Protocol (NTP) SNTP components, specifically the sntp utility, prior to version 4.2.7p366. The root cause is an incorrect type conversion in the ULOGTOD function (precision → double) which can cause a crafted NTP packet to trigger an infinite loop in sntp, l...

CVE-2015-4604

CVE-2015-4604 affects PHP’s Fileinfo extension (mget function in softmagic.c). The vulnerability arises from an improper pointer relationship in 5.x Fileinfo handling, enabling a remote attacker to cause a denial of service (application crash) or potentially execute arbitrary code via a crafted s...

CVE-2016-4470

CVE-2016-4470 affects the Linux kernel keyring handling: in key_reject_and_link() an uninitialized pointer may be dereferenced after an error, enabling a local attacker to trigger a denial of service (system crash) via crafted keyctl request2. Connected advisories confirm this is a kernel issue w...

CVE-2015-4142

CVE-2015-4142 involves an integer underflow in the WMM Action frame processing when hostapd/wpa_supplicant run in AP mode (MLME/SME). A crafted frame can trigger an out-of-bounds read, potentially crashing the daemon. Affected products include hostapd and wpa_supplicant (various versions up to 2....

CVE-2015-4819

CVE-2015-4819: An unspecified vulnerability in Oracle MySQL Server affecting 5.5.44 and earlier and 5.6.25 and earlier, located in the Client programs component. It has complete impact on confidentiality, integrity, and availability. The IBM Guardium bulletin (CVE reference list) documents this C...

CVE-2015-8540

CVE-2015-8540: libpng contains an integer underflow in png_check_keyword (pngwutil.c) that allows remote attackers to trigger an out-of-bounds read via a space character used as a PNG keyword. Affected families include libpng 0.90–0.99, 1.0.x before 1.0.66, 1.1.x and 1.2.x before 1.2.56, 1.3.x an...

CVE-2012-5689

The CVE-2012-5689 issue affects ISC BIND 9.8.x–9.9.2-P1 when DNS64 with RPZ is used without an AAAA rewrite rule, allowing remote attackers to cause a DoS via an AAAA query (assertion failure and named exit). Affected configurations point to DNS64 + RPZ Rewriting; mitigation in practice is to ens...