Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 83

CVE-2016-4809

libarchive: Memory allocate error with symbolic links in cpio archives

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.

CVSS 3.0 · 7.5 High EPSS 4.8% KEV · Not listed
Vendors
Libarchive Oracle Redhat
Products
Libarchive Linux Enterprise Linux and 7 more
CVE-2015-2348

php: move_uploaded_file() NUL byte injection in file name

The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 5.0 Medium EPSS 8.3% KEV · Not listed
Vendors
Apple Opensuse Php and 1 more
Products
Mac Os X Opensuse Php and 8 more
CVE-2015-2783

php: buffer over-read in Phar metadata parsing

ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions.

CVSS 2.0 · 5.8 Medium EPSS 9.0% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-3330

php: pipelined request executed in deinitialized interpreter under httpd 2.4

The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

CVSS 2.0 · 6.8 Medium EPSS 13.5% KEV · Not listed
Vendors
Apple Oracle Php and 1 more
Products
Mac Os X Linux Solaris and 9 more
CVE-2015-3411

php: missing null byte checks for paths in various PHP extensions

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that bypasses an intended configuration in which client users may read only .xml files.

CVSS 3.0 · 6.5 Medium EPSS 3.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4021

php: memory corruption in phar_parse_tarfile caused by empty entry file name

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

CVSS 2.0 · 5.0 Medium EPSS 20.5% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4024

php: multipart/form-data request parsing CPU usage DoS

Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome.

CVSS 2.0 · 5.0 Medium EPSS 41.8% KEV · Not listed
Vendors
Apple Hp Oracle and 2 more
Products
Mac Os X System Management Homepage Linux and 10 more
CVE-2015-4025

php: regressions in 5.4+

PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.

CVSS 2.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Apple Php Redhat
Products
Mac Os X Php Enterprise Linux and 7 more
CVE-2015-4598

php: missing null byte checks for paths in DOM and GD extensions

PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may write to only .html files.

CVSS 3.0 · 6.5 Medium EPSS 3.8% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4599

php: type confusion issue in unserialize() with various SOAP methods

The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4600

php: type confusion issue in unserialize() with various SOAP methods

The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4601

php: type confusion issue in unserialize() with various SOAP methods

PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.

CVSS 3.0 · 9.8 Critical EPSS 7.9% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4602

php: Incomplete Class unserialization type confusion

The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.3% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-4603

php: exception:: getTraceAsString type confusion issue after unserialize

The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Enterprise Linux Desktop and 6 more
CVE-2015-5260

spice: insufficient validation of surface_id parameter can cause crash

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2015-5261

spice: host memory access from guest using crafted images

Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Enterprise Linux and 7 more
CVE-2016-2150

spice: Host memory access from guest with invalid primary surface parameters

SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261.

CVSS 3.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Debian Microsoft Opensuse and 2 more
Products
Debian Linux Windows Leap and 9 more
CVE-2015-7547

glibc: getaddrinfo stack-based buffer overflow

Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.

CVSS 3.0 · 8.1 High EPSS 92.4% KEV · Not listed
Vendors
Canonical Debian F5 and 7 more
Products
Ubuntu Linux Debian Linux Big-ip Access Policy Manager and 31 more