Vulnerability-Lookup

RHSA-2016:2750

Vulnerability from csaf_redhat - Published: 2016-11-15 11:40 - Updated: 2026-08-04 21:57

Summary

Red Hat Security Advisory: rh-php56 security, bug fix, and enhancement update

Severity

Moderate

Notes

Topic: An update for rh-php56, rh-php56-php, and rh-php56-php-pear is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The rh-php56 packages provide a recent stable release of PHP with PEAR 1.9.5 and enhanced language features including constant expressions, variadic functions, arguments unpacking, and the interactive debuger. The memcache, mongo, and XDebug extensions are also included. The rh-php56 Software Collection has been upgraded to version 5.6.25, which provides a number of bug fixes and enhancements over the previous version. (BZ#1356157, BZ#1365401) Security Fixes in the rh-php56-php component: * Several Moderate and Low impact security issues were found in PHP. Under certain circumstances, these issues could cause PHP to crash, disclose portions of its memory, execute arbitrary code, or impact PHP application integrity. Space precludes documenting each of these issues in this advisory. Refer to the CVE links in the References section for a description of each of these vulnerabilities. (CVE-2013-7456, CVE-2014-9767, CVE-2015-8835, CVE-2015-8865, CVE-2015-8866, CVE-2015-8867, CVE-2015-8873, CVE-2015-8874, CVE-2015-8876, CVE-2015-8877, CVE-2015-8879, CVE-2016-1903, CVE-2016-2554, CVE-2016-3074, CVE-2016-3141, CVE-2016-3142, CVE-2016-4070, CVE-2016-4071, CVE-2016-4072, CVE-2016-4073, CVE-2016-4342, CVE-2016-4343, CVE-2016-4473, CVE-2016-4537, CVE-2016-4538, CVE-2016-4539, CVE-2016-4540, CVE-2016-4541, CVE-2016-4542, CVE-2016-4543, CVE-2016-4544, CVE-2016-5093, CVE-2016-5094, CVE-2016-5096, CVE-2016-5114, CVE-2016-5399, CVE-2016-5766, CVE-2016-5767, CVE-2016-5768, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6128, CVE-2016-6207, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297, CVE-2016-7124, CVE-2016-7125, CVE-2016-7126, CVE-2016-7127, CVE-2016-7128, CVE-2016-7129, CVE-2016-7130, CVE-2016-7131, CVE-2016-7132) * Multiple flaws were found in the PCRE library included with the rh-php56-php packages for Red Hat Enterprise Linux 6. A specially crafted regular expression could cause PHP to crash or, possibly, execute arbitrary code. (CVE-2015-2325, CVE-2015-2326, CVE-2015-2327, CVE-2015-2328, CVE-2015-3210, CVE-2015-3217, CVE-2015-5073, CVE-2015-8381, CVE-2015-8383, CVE-2015-8384, CVE-2015-8385, CVE-2015-8386, CVE-2015-8388, CVE-2015-8391, CVE-2015-8392, CVE-2015-8395) Red Hat would like to thank Hans Jerry Illikainen for reporting CVE-2016-3074, CVE-2016-4473, and CVE-2016-5399.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2013-7456

gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products

Product	Version	Remediation
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-0:2.3-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-0:5.6.25-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-bcmath-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-cli-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-common-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-dba-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-dbg-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-debuginfo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-devel-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-embedded-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-enchant-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-fpm-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-gd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-gmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-imap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-intl-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-ldap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-mbstring-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-mysqlnd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-odbc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-opcache-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-pdo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-pear-1:1.9.5-4.el6.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-pear-1:1.9.5-4.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-pgsql-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-process-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-pspell-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-recode-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-snmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-soap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-tidy-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-xml-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-php-xmlrpc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-runtime-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3-6.7.Z:rh-php56-scldevel-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-0:2.3-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-bcmath-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-cli-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-common-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-dba-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-dbg-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-debuginfo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-devel-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-embedded-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-enchant-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-fpm-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-gd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-gmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-imap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-intl-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-ldap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-mbstring-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-mysqlnd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-odbc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-opcache-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-pdo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el6.noarch	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el6.src	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-pgsql-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-process-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-pspell-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-recode-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-snmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-soap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-tidy-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-xml-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-php-xmlrpc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-runtime-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Server-RHSCL-2.3:rh-php56-scldevel-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-0:2.3-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el6.src	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-bcmath-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-cli-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-common-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-dba-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-dbg-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-debuginfo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-devel-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-embedded-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-enchant-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-fpm-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-gd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-gmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-imap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-intl-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-ldap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-mbstring-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-mysqlnd-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-odbc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-opcache-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-pdo-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el6.noarch	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el6.src	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-pgsql-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-process-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-pspell-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-recode-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-snmp-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-soap-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-tidy-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-xml-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-php-xmlrpc-0:5.6.25-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-runtime-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 6Workstation-RHSCL-2.3:rh-php56-scldevel-0:2.3-1.el6.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-0:2.3-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-0:5.6.25-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-bcmath-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-cli-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-common-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-dba-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-dbg-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-debuginfo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-devel-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-embedded-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-enchant-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-fpm-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-gd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-gmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-intl-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-ldap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-mbstring-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-mysqlnd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-odbc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-opcache-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-pdo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-pear-1:1.9.5-4.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-pear-1:1.9.5-4.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-pgsql-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-process-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-pspell-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-recode-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-snmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-soap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-xml-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-php-xmlrpc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-runtime-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.2.Z:rh-php56-scldevel-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-0:2.3-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-0:5.6.25-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-bcmath-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-cli-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-common-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-dba-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-dbg-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-debuginfo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-devel-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-embedded-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-enchant-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-fpm-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-gd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-gmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-intl-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-ldap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-mbstring-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-mysqlnd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-odbc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-opcache-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-pdo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-pear-1:1.9.5-4.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-pear-1:1.9.5-4.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-pgsql-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-process-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-pspell-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-recode-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-snmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-soap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-xml-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-php-xmlrpc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-runtime-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3-7.3.Z:rh-php56-scldevel-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-0:2.3-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-bcmath-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-cli-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-common-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-dba-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-dbg-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-debuginfo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-devel-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-embedded-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-enchant-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-fpm-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-gd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-gmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-intl-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-ldap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-mbstring-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-mysqlnd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-odbc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-opcache-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-pdo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el7.src	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-pgsql-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-process-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-pspell-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-recode-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-snmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-soap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-xml-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-php-xmlrpc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-runtime-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Server-RHSCL-2.3:rh-php56-scldevel-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-0:2.3-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el7.src	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-bcmath-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-cli-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-common-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-dba-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-dbg-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-debuginfo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-devel-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-embedded-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-enchant-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-fpm-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-gd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-gmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-intl-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-ldap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-mbstring-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-mysqlnd-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-odbc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-opcache-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-pdo-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el7.noarch	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-pear-1:1.9.5-4.el7.src	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-pgsql-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-process-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-pspell-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-recode-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-snmp-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-soap-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-xml-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-php-xmlrpc-0:5.6.25-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-runtime-0:2.3-1.el7.x86_64	—	Vendor Fix fix
Unresolved product id: 7Workstation-RHSCL-2.3:rh-php56-scldevel-0:2.3-1.el7.x86_64	—	Vendor Fix fix

Threats

Impact Low

CVE-2014-9767

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:P/A:N

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-2325

The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-2326

The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-2327

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-2328

PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-3210

Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P<B>c)(?P<B>a(?P=B)))>WGXCREDITS)/, a different vulnerability than CVE-2015-8384.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-3217

PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\.|([^\\\\W_])?)+)+$/.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-5073

Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8381

The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8383

PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8384

PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8385

PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8386

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8388

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8391

The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-407 - Inefficient Algorithmic Complexity

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8392

PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8395

PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Important

CVE-2015-8835

The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote attackers to cause a denial of service (NULL pointer dereference, type confusion, and application crash) or possibly execute arbitrary code via crafted serialized data representing a numerically indexed _cookies array, related to the SoapClient::__call method in ext/soap/soap.c.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8865

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8866

ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8867

The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8873

Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service (segmentation fault) via recursive method calls.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8874

Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-674 - Uncontrolled Recursion

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8876

Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-502 - Deserialization of Untrusted Data

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2015-8877

The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-772 - Missing Release of Resource after Effective Lifetime

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8879

The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2015-8935

The header() PHP function allowed header stings containing line break followed by a space or tab, as allowed by RFC 2616. Certain browsers handled the continuation line as new header, making it possible to conduct a HTTP response splitting attack against such browsers. The header() function was updated to follow RFC 7230 and not allow any line breaks.

3.1 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-1903

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted image file could cause a PHP application using the imagerotate() function to disclose portions of the server memory or crash the PHP application.

5.0 ()


                
                  AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-2554

Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-3074

Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted compressed gd2 data, which triggers a heap-based buffer overflow.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-3141

Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact by triggering a wddx_deserialize call on XML data containing a crafted var element.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-3142

The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid location.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4070

Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says "Not sure if this qualifies as security issue (probably not).

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4071

Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call.

5.0 (Medium)


                
                  CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-134 - Use of Externally-Controlled Format String

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4072

The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c.

4.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE-787 - Out-of-bounds Write

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4073

Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call.

4.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4342

ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompressed data, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR archive.

8.1 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-665 - Improper Initialization

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4343

The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.

8.1 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-456 - Missing Initialization of a Variable

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4473

/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-4537

The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:P/A:N

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4538

The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:P/A:N

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4539

The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4540

The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4541

The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4542

The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4543

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-4544

The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

2.6 ()


                
                  AV:N/AC:H/Au:N/C:N/I:N/A:P

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5093

The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.

4.3 ()


                
                  AV:N/AC:M/Au:N/C:P/I:N/A:N

CWE-170 - Improper Null Termination

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5094

Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5096

Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

5.1 ()


                
                  AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5114

An out-of-bounds write flaw was found in the fpm_log_write() logging function of PHP's FastCGI Process Manager service. A remote attacker could repeatedly send maliciously crafted requests to force FPM to exhaust file system space, creating a denial of service and preventing further logging.

5.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:N

CWE-787 - Out-of-bounds Write

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5399

A flaw was found in the way certain error conditions were handled by bzread() function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code with the permissions of the user running the PHP application.

8.1 (High)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-390 - Detection of Error Condition Without Action

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5766

An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5767

An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5768

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5770

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5771

spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-5772

Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-5773

php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and application crash) via crafted serialized data containing a ZipArchive object.

5.6 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6128

It was found that libgd did not properly handle invalid color indexes in GD files. An attacker who could submit a crafted GD file for conversion could cause applications using libgd to crash, leading to denial of service.

3.7 (Low)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-20 - Improper Input Validation

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-6207

Integer overflow in the _gdContributionsAlloc function in gd_interpolation.c in GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of service (out-of-bounds memory write or memory consumption) via unspecified vectors.

6.2 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6288

The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.

6.2 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-6289

Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6290

ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors related to session deserialization.

7.0 (High)


                
                  CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6291

The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds array access and memory corruption), obtain sensitive information from process memory, or possibly have unspecified other impact via a crafted JPEG image.

4.8 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6292

The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted JPEG image.

6.2 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-476 - NULL Pointer Dereference

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-6294

The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

4.4 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

CWE-125 - Out-of-bounds Read

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-6295

ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data, a related issue to CVE-2016-5773.

7.0 (High)


                
                  CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6296

Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.

7.0 (High)


                
                  CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-6297

Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted zip:// URL.

7.4 (High)


                
                  CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Low

CVE-2016-7124

ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.

4.8 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7125

ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7126

The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7127

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7128

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7129

The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7130

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7131

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

CVE-2016-7132

ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 251 products, the same list as for CVE-2013-7456

Threats

Impact Moderate

References

388 references

URL	Category
https://access.redhat.com/errata/RHSA-2016:2750	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=1207198	external
https://bugzilla.redhat.com/show_bug.cgi?id=1207202	external
https://bugzilla.redhat.com/show_bug.cgi?id=1228283	external
https://bugzilla.redhat.com/show_bug.cgi?id=1237223	external
https://bugzilla.redhat.com/show_bug.cgi?id=1260716	external
https://bugzilla.redhat.com/show_bug.cgi?id=1285399	external
https://bugzilla.redhat.com/show_bug.cgi?id=1285408	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287614	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287623	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287629	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287636	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287671	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287690	external
https://bugzilla.redhat.com/show_bug.cgi?id=1287711	external
https://bugzilla.redhat.com/show_bug.cgi?id=1297710	external
https://bugzilla.redhat.com/show_bug.cgi?id=1297717	external
https://bugzilla.redhat.com/show_bug.cgi?id=1305536	external
https://bugzilla.redhat.com/show_bug.cgi?id=1305543	external
https://bugzilla.redhat.com/show_bug.cgi?id=1315312	external
https://bugzilla.redhat.com/show_bug.cgi?id=1315328	external
https://bugzilla.redhat.com/show_bug.cgi?id=1321893	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323074	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323103	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323106	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323108	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323114	external
https://bugzilla.redhat.com/show_bug.cgi?id=1323118	external
https://bugzilla.redhat.com/show_bug.cgi?id=1330418	external
https://bugzilla.redhat.com/show_bug.cgi?id=1330420	external
https://bugzilla.redhat.com/show_bug.cgi?id=1332454	external
https://bugzilla.redhat.com/show_bug.cgi?id=1332860	external
https://bugzilla.redhat.com/show_bug.cgi?id=1332865	external
https://bugzilla.redhat.com/show_bug.cgi?id=1332872	external
https://bugzilla.redhat.com/show_bug.cgi?id=1332877	external
https://bugzilla.redhat.com/show_bug.cgi?id=1336772	external
https://bugzilla.redhat.com/show_bug.cgi?id=1336775	external
https://bugzilla.redhat.com/show_bug.cgi?id=1338896	external
https://bugzilla.redhat.com/show_bug.cgi?id=1338907	external
https://bugzilla.redhat.com/show_bug.cgi?id=1338912	external
https://bugzilla.redhat.com/show_bug.cgi?id=1339590	external
https://bugzilla.redhat.com/show_bug.cgi?id=1339949	external
https://bugzilla.redhat.com/show_bug.cgi?id=1340433	external
https://bugzilla.redhat.com/show_bug.cgi?id=1340738	external
https://bugzilla.redhat.com/show_bug.cgi?id=1347772	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351068	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351069	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351168	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351171	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351173	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351175	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351179	external
https://bugzilla.redhat.com/show_bug.cgi?id=1351603	external
https://bugzilla.redhat.com/show_bug.cgi?id=1358395	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359698	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359710	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359718	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359756	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359800	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359811	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359815	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359822	external
https://bugzilla.redhat.com/show_bug.cgi?id=1359828	external
https://bugzilla.redhat.com/show_bug.cgi?id=1360322	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374697	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374698	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374699	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374701	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374704	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374705	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374707	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374708	external
https://bugzilla.redhat.com/show_bug.cgi?id=1374711	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2013-7456	self
https://bugzilla.redhat.com/show_bug.cgi?id=1340433	external
https://www.cve.org/CVERecord?id=CVE-2013-7456	external
https://nvd.nist.gov/vuln/detail/CVE-2013-7456	external
https://access.redhat.com/security/cve/CVE-2014-9767	self
https://bugzilla.redhat.com/show_bug.cgi?id=1260716	external
https://www.cve.org/CVERecord?id=CVE-2014-9767	external
https://nvd.nist.gov/vuln/detail/CVE-2014-9767	external
https://access.redhat.com/security/cve/CVE-2015-2325	self
https://bugzilla.redhat.com/show_bug.cgi?id=1207198	external
https://www.cve.org/CVERecord?id=CVE-2015-2325	external
https://nvd.nist.gov/vuln/detail/CVE-2015-2325	external
https://access.redhat.com/security/cve/CVE-2015-2326	self
https://bugzilla.redhat.com/show_bug.cgi?id=1207202	external
https://www.cve.org/CVERecord?id=CVE-2015-2326	external
https://nvd.nist.gov/vuln/detail/CVE-2015-2326	external
https://access.redhat.com/security/cve/CVE-2015-2327	self
https://bugzilla.redhat.com/show_bug.cgi?id=1285408	external
https://www.cve.org/CVERecord?id=CVE-2015-2327	external
https://nvd.nist.gov/vuln/detail/CVE-2015-2327	external
https://access.redhat.com/security/cve/CVE-2015-2328	self
https://bugzilla.redhat.com/show_bug.cgi?id=1285399	external
https://www.cve.org/CVERecord?id=CVE-2015-2328	external
https://nvd.nist.gov/vuln/detail/CVE-2015-2328	external
https://access.redhat.com/security/cve/CVE-2015-3210	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287623	external
https://www.cve.org/CVERecord?id=CVE-2015-3210	external
https://nvd.nist.gov/vuln/detail/CVE-2015-3210	external
https://access.redhat.com/security/cve/CVE-2015-3217	self
https://bugzilla.redhat.com/show_bug.cgi?id=1228283	external
https://www.cve.org/CVERecord?id=CVE-2015-3217	external
https://nvd.nist.gov/vuln/detail/CVE-2015-3217	external
https://access.redhat.com/security/cve/CVE-2015-5073	self
https://bugzilla.redhat.com/show_bug.cgi?id=1237223	external
https://www.cve.org/CVERecord?id=CVE-2015-5073	external
https://nvd.nist.gov/vuln/detail/CVE-2015-5073	external
https://access.redhat.com/security/cve/CVE-2015-8381	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287711	external
https://www.cve.org/CVERecord?id=CVE-2015-8381	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8381	external
https://access.redhat.com/security/cve/CVE-2015-8383	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287614	external
https://www.cve.org/CVERecord?id=CVE-2015-8383	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8383	external
https://access.redhat.com/security/cve/CVE-2015-8384	self
https://www.cve.org/CVERecord?id=CVE-2015-8384	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8384	external
https://access.redhat.com/security/cve/CVE-2015-8385	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287629	external
https://www.cve.org/CVERecord?id=CVE-2015-8385	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8385	external
https://access.redhat.com/security/cve/CVE-2015-8386	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287636	external
https://www.cve.org/CVERecord?id=CVE-2015-8386	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8386	external
https://access.redhat.com/security/cve/CVE-2015-8388	self
https://www.cve.org/CVERecord?id=CVE-2015-8388	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8388	external
https://access.redhat.com/security/cve/CVE-2015-8391	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287671	external
https://www.cve.org/CVERecord?id=CVE-2015-8391	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8391	external
https://access.redhat.com/security/cve/CVE-2015-8392	self
https://bugzilla.redhat.com/show_bug.cgi?id=1287690	external
https://www.cve.org/CVERecord?id=CVE-2015-8392	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8392	external
https://access.redhat.com/security/cve/CVE-2015-8395	self
https://www.cve.org/CVERecord?id=CVE-2015-8395	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8395	external
https://access.redhat.com/security/cve/CVE-2015-8835	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323074	external
https://www.cve.org/CVERecord?id=CVE-2015-8835	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8835	external
https://access.redhat.com/security/cve/CVE-2015-8865	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323118	external
https://www.cve.org/CVERecord?id=CVE-2015-8865	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8865	external
https://access.redhat.com/security/cve/CVE-2015-8866	self
https://bugzilla.redhat.com/show_bug.cgi?id=1330418	external
https://www.cve.org/CVERecord?id=CVE-2015-8866	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8866	external
https://access.redhat.com/security/cve/CVE-2015-8867	self
https://bugzilla.redhat.com/show_bug.cgi?id=1330420	external
https://www.cve.org/CVERecord?id=CVE-2015-8867	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8867	external
https://access.redhat.com/security/cve/CVE-2015-8873	self
https://bugzilla.redhat.com/show_bug.cgi?id=1336775	external
https://www.cve.org/CVERecord?id=CVE-2015-8873	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8873	external
https://access.redhat.com/security/cve/CVE-2015-8874	self
https://bugzilla.redhat.com/show_bug.cgi?id=1336772	external
https://www.cve.org/CVERecord?id=CVE-2015-8874	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8874	external
https://access.redhat.com/security/cve/CVE-2015-8876	self
https://bugzilla.redhat.com/show_bug.cgi?id=1338896	external
https://www.cve.org/CVERecord?id=CVE-2015-8876	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8876	external
https://access.redhat.com/security/cve/CVE-2015-8877	self
https://bugzilla.redhat.com/show_bug.cgi?id=1338907	external
https://www.cve.org/CVERecord?id=CVE-2015-8877	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8877	external
https://access.redhat.com/security/cve/CVE-2015-8879	self
https://bugzilla.redhat.com/show_bug.cgi?id=1338912	external
https://www.cve.org/CVERecord?id=CVE-2015-8879	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8879	external
https://access.redhat.com/security/cve/CVE-2015-8935	self
https://bugzilla.redhat.com/show_bug.cgi?id=1348927	external
https://www.cve.org/CVERecord?id=CVE-2015-8935	external
https://nvd.nist.gov/vuln/detail/CVE-2015-8935	external
https://access.redhat.com/security/cve/CVE-2016-1903	self
https://bugzilla.redhat.com/show_bug.cgi?id=1297717	external
https://www.cve.org/CVERecord?id=CVE-2016-1903	external
https://nvd.nist.gov/vuln/detail/CVE-2016-1903	external
https://access.redhat.com/security/cve/CVE-2016-2554	self
https://bugzilla.redhat.com/show_bug.cgi?id=1305543	external
https://www.cve.org/CVERecord?id=CVE-2016-2554	external
https://nvd.nist.gov/vuln/detail/CVE-2016-2554	external
https://access.redhat.com/security/cve/CVE-2016-3074	self
https://bugzilla.redhat.com/show_bug.cgi?id=1321893	external
https://www.cve.org/CVERecord?id=CVE-2016-3074	external
https://nvd.nist.gov/vuln/detail/CVE-2016-3074	external
https://access.redhat.com/security/cve/CVE-2016-3141	self
https://bugzilla.redhat.com/show_bug.cgi?id=1315328	external
https://www.cve.org/CVERecord?id=CVE-2016-3141	external
https://nvd.nist.gov/vuln/detail/CVE-2016-3141	external
https://access.redhat.com/security/cve/CVE-2016-3142	self
https://bugzilla.redhat.com/show_bug.cgi?id=1315312	external
https://www.cve.org/CVERecord?id=CVE-2016-3142	external
https://nvd.nist.gov/vuln/detail/CVE-2016-3142	external
https://access.redhat.com/security/cve/CVE-2016-4070	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323114	external
https://www.cve.org/CVERecord?id=CVE-2016-4070	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4070	external
https://access.redhat.com/security/cve/CVE-2016-4071	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323108	external
https://www.cve.org/CVERecord?id=CVE-2016-4071	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4071	external
https://access.redhat.com/security/cve/CVE-2016-4072	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323106	external
https://www.cve.org/CVERecord?id=CVE-2016-4072	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4072	external
https://access.redhat.com/security/cve/CVE-2016-4073	self
https://bugzilla.redhat.com/show_bug.cgi?id=1323103	external
https://www.cve.org/CVERecord?id=CVE-2016-4073	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4073	external
https://access.redhat.com/security/cve/CVE-2016-4342	self
https://bugzilla.redhat.com/show_bug.cgi?id=1305536	external
https://www.cve.org/CVERecord?id=CVE-2016-4342	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4342	external
https://access.redhat.com/security/cve/CVE-2016-4343	self
https://bugzilla.redhat.com/show_bug.cgi?id=1332454	external
https://www.cve.org/CVERecord?id=CVE-2016-4343	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4343	external
https://access.redhat.com/security/cve/CVE-2016-4473	self
https://bugzilla.redhat.com/show_bug.cgi?id=1347772	external
https://www.cve.org/CVERecord?id=CVE-2016-4473	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4473	external
https://access.redhat.com/security/cve/CVE-2016-4537	self
https://bugzilla.redhat.com/show_bug.cgi?id=1332860	external
https://www.cve.org/CVERecord?id=CVE-2016-4537	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4537	external
https://access.redhat.com/security/cve/CVE-2016-4538	self
https://www.cve.org/CVERecord?id=CVE-2016-4538	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4538	external
https://access.redhat.com/security/cve/CVE-2016-4539	self
https://bugzilla.redhat.com/show_bug.cgi?id=1332877	external
https://www.cve.org/CVERecord?id=CVE-2016-4539	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4539	external
https://access.redhat.com/security/cve/CVE-2016-4540	self
https://bugzilla.redhat.com/show_bug.cgi?id=1332872	external
https://www.cve.org/CVERecord?id=CVE-2016-4540	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4540	external
https://access.redhat.com/security/cve/CVE-2016-4541	self
https://www.cve.org/CVERecord?id=CVE-2016-4541	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4541	external
https://access.redhat.com/security/cve/CVE-2016-4542	self
https://bugzilla.redhat.com/show_bug.cgi?id=1332865	external
https://www.cve.org/CVERecord?id=CVE-2016-4542	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4542	external
https://access.redhat.com/security/cve/CVE-2016-4543	self
https://www.cve.org/CVERecord?id=CVE-2016-4543	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4543	external
https://access.redhat.com/security/cve/CVE-2016-4544	self
https://www.cve.org/CVERecord?id=CVE-2016-4544	external
https://nvd.nist.gov/vuln/detail/CVE-2016-4544	external
https://access.redhat.com/security/cve/CVE-2016-5093	self
https://bugzilla.redhat.com/show_bug.cgi?id=1339590	external
https://www.cve.org/CVERecord?id=CVE-2016-5093	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5093	external
https://access.redhat.com/security/cve/CVE-2016-5094	self
https://bugzilla.redhat.com/show_bug.cgi?id=1340738	external
https://www.cve.org/CVERecord?id=CVE-2016-5094	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5094	external
https://access.redhat.com/security/cve/CVE-2016-5096	self
https://bugzilla.redhat.com/show_bug.cgi?id=1339949	external
https://www.cve.org/CVERecord?id=CVE-2016-5096	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5096	external
https://access.redhat.com/security/cve/CVE-2016-5114	self
https://bugzilla.redhat.com/show_bug.cgi?id=1297710	external
https://www.cve.org/CVERecord?id=CVE-2016-5114	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5114	external
https://access.redhat.com/security/cve/CVE-2016-5399	self
https://bugzilla.redhat.com/show_bug.cgi?id=1358395	external
https://www.cve.org/CVERecord?id=CVE-2016-5399	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5399	external
https://access.redhat.com/security/cve/CVE-2016-5766	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351068	external
https://www.cve.org/CVERecord?id=CVE-2016-5766	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5766	external
https://access.redhat.com/security/cve/CVE-2016-5767	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351069	external
https://www.cve.org/CVERecord?id=CVE-2016-5767	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5767	external
https://access.redhat.com/security/cve/CVE-2016-5768	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351168	external
https://www.cve.org/CVERecord?id=CVE-2016-5768	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5768	external
https://access.redhat.com/security/cve/CVE-2016-5770	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351171	external
https://www.cve.org/CVERecord?id=CVE-2016-5770	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5770	external
https://access.redhat.com/security/cve/CVE-2016-5771	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351173	external
https://www.cve.org/CVERecord?id=CVE-2016-5771	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5771	external
https://access.redhat.com/security/cve/CVE-2016-5772	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351175	external
https://www.cve.org/CVERecord?id=CVE-2016-5772	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5772	external
https://access.redhat.com/security/cve/CVE-2016-5773	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351179	external
https://www.cve.org/CVERecord?id=CVE-2016-5773	external
https://nvd.nist.gov/vuln/detail/CVE-2016-5773	external
https://access.redhat.com/security/cve/CVE-2016-6128	self
https://bugzilla.redhat.com/show_bug.cgi?id=1351603	external
https://www.cve.org/CVERecord?id=CVE-2016-6128	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6128	external
https://access.redhat.com/security/cve/CVE-2016-6207	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359800	external
https://www.cve.org/CVERecord?id=CVE-2016-6207	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6207	external
https://access.redhat.com/security/cve/CVE-2016-6288	self
https://bugzilla.redhat.com/show_bug.cgi?id=1360322	external
https://www.cve.org/CVERecord?id=CVE-2016-6288	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6288	external
https://access.redhat.com/security/cve/CVE-2016-6289	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359698	external
https://www.cve.org/CVERecord?id=CVE-2016-6289	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6289	external
https://access.redhat.com/security/cve/CVE-2016-6290	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359710	external
https://www.cve.org/CVERecord?id=CVE-2016-6290	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6290	external
https://access.redhat.com/security/cve/CVE-2016-6291	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359718	external
https://www.cve.org/CVERecord?id=CVE-2016-6291	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6291	external
https://access.redhat.com/security/cve/CVE-2016-6292	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359756	external
https://www.cve.org/CVERecord?id=CVE-2016-6292	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6292	external
https://access.redhat.com/security/cve/CVE-2016-6294	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359811	external
https://www.cve.org/CVERecord?id=CVE-2016-6294	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6294	external
https://access.redhat.com/security/cve/CVE-2016-6295	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359815	external
https://www.cve.org/CVERecord?id=CVE-2016-6295	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6295	external
https://access.redhat.com/security/cve/CVE-2016-6296	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359822	external
https://www.cve.org/CVERecord?id=CVE-2016-6296	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6296	external
https://access.redhat.com/security/cve/CVE-2016-6297	self
https://bugzilla.redhat.com/show_bug.cgi?id=1359828	external
https://www.cve.org/CVERecord?id=CVE-2016-6297	external
https://nvd.nist.gov/vuln/detail/CVE-2016-6297	external
https://access.redhat.com/security/cve/CVE-2016-7124	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374697	external
https://www.cve.org/CVERecord?id=CVE-2016-7124	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7124	external
https://access.redhat.com/security/cve/CVE-2016-7125	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374698	external
https://www.cve.org/CVERecord?id=CVE-2016-7125	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7125	external
https://access.redhat.com/security/cve/CVE-2016-7126	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374699	external
https://www.cve.org/CVERecord?id=CVE-2016-7126	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7126	external
https://access.redhat.com/security/cve/CVE-2016-7127	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374701	external
https://www.cve.org/CVERecord?id=CVE-2016-7127	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7127	external
https://access.redhat.com/security/cve/CVE-2016-7128	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374704	external
https://www.cve.org/CVERecord?id=CVE-2016-7128	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7128	external
https://access.redhat.com/security/cve/CVE-2016-7129	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374705	external
https://www.cve.org/CVERecord?id=CVE-2016-7129	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7129	external
https://access.redhat.com/security/cve/CVE-2016-7130	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374707	external
https://www.cve.org/CVERecord?id=CVE-2016-7130	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7130	external
https://access.redhat.com/security/cve/CVE-2016-7131	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374708	external
https://www.cve.org/CVERecord?id=CVE-2016-7131	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7131	external
https://access.redhat.com/security/cve/CVE-2016-7132	self
https://bugzilla.redhat.com/show_bug.cgi?id=1374711	external
https://www.cve.org/CVERecord?id=CVE-2016-7132	external
https://nvd.nist.gov/vuln/detail/CVE-2016-7132	external

Acknowledgments

Hans Jerry Illikainen

JSON

To clipboard

Loading 4.8 MB of JSON…

BDU:2017-01772 (CVE-2016-4473)

Vulnerability from fstec – Published: 2017-08-10 – Updated: 2021-03-23 – View on bdu.fstec.ru Fixed

Title

Уязвимость компонента /ext/phar/phar_object.c интерпретатора PHP, позволяющая нарушителю выполнить произвольный код

Summary

Уязвимость компонента /ext/phar/phar_object.c интерпретатора PHP связана с использованием памяти после её освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-416 - Использование после освобождения

Aliases

CVE-2016-4473, RHSA-2016:2750, BID, ID:98999, SUSE-SU-2016:2460

References

4 references

URL
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html
http://rhn.redhat.com/errata/RHSA-2016-2750.html
http://www.securityfocus.com/bid/98999
https://bugzilla.redhat.com/show_bug.cgi?id=1347772

Impacted products

1 product from 1 vendor

Vendors

PHP Group

Products

PHP

Versions

5.6 (PHP), 7.0.7 (PHP)

Product types

Application software

Mitigations

Использование рекоменаций: http://rhn.redhat.com/errata/RHSA-2016-2750.html

Credits

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "PHP Group",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "5.6 (PHP), 7.0.7 (PHP)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0430\u0446\u0438\u0439: http://rhn.redhat.com/errata/RHSA-2016-2750.html",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "08.06.2017",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "23.03.2021",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "10.08.2017",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2017-01772",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2016-4473, RHSA-2016:2750, BID ID:98999, SUSE-SU-2016:2460",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "PHP",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 /ext/phar/phar_object.c \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 PHP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f (CWE-416)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 /ext/phar/phar_object.c \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440\u0430 PHP \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0451 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": "-",
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00007.html\nhttp://rhn.redhat.com/errata/RHSA-2016-2750.html\nhttp://www.securityfocus.com/bid/98999\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1347772",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-416",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2013-7456 (GCVE-0-2013-7456)

Vulnerability from cvelistv5 – Published: 2016-08-07 10:00 – Updated: 2024-08-06 18:09

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

12 references

URL	Tags
http://www.securityfocus.com/bid/90859	vdb-entryx_refsource_BID
http://www.openwall.com/lists/oss-security/2016/05/26/3	mailing-listx_refsource_MLIST
https://bugs.php.net/bug.php?id=72227	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2016/dsa-3602	vendor-advisoryx_refsource_DEBIAN
https://github.com/php/php-src/commit/7a1aac3343a…	x_refsource_CONFIRM
https://github.com/libgd/libgd/commit/4f65a3e4eed…	x_refsource_CONFIRM
http://php.net/ChangeLog-5.php	x_refsource_CONFIRM
http://php.net/ChangeLog-7.php	x_refsource_CONFIRM
https://h20566.www2.hpe.com/portal/site/hpsc/publ…	x_refsource_CONFIRM
http://www.debian.org/security/2016/dsa-3587	vendor-advisoryx_refsource_DEBIAN
http://www.ubuntu.com/usn/USN-3030-1	vendor-advisoryx_refsource_UBUNTU

Date Public

2016-05-26 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:09:17.049Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "90859",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/90859"
          },
          {
            "name": "[oss-security] 20160526 Re: Fwd: CVE for PHP 5.5.36 issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/05/26/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=72227"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "name": "DSA-3602",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3602"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/php/php-src/commit/7a1aac3343af85b4af4df5f8844946eaa27394ab?w=1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/libgd/libgd/commit/4f65a3e4eedaffa1efcf9ee1eb08f0b504fbc31a"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://php.net/ChangeLog-5.php"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://php.net/ChangeLog-7.php"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731"
          },
          {
            "name": "DSA-3587",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3587"
          },
          {
            "name": "USN-3030-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-3030-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-05-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "90859",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/90859"
        },
        {
          "name": "[oss-security] 20160526 Re: Fwd: CVE for PHP 5.5.36 issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/05/26/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=72227"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "name": "DSA-3602",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3602"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/php/php-src/commit/7a1aac3343af85b4af4df5f8844946eaa27394ab?w=1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libgd/libgd/commit/4f65a3e4eedaffa1efcf9ee1eb08f0b504fbc31a"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://php.net/ChangeLog-5.php"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://php.net/ChangeLog-7.php"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731"
        },
        {
          "name": "DSA-3587",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3587"
        },
        {
          "name": "USN-3030-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-3030-1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2013-7456",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "90859",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/90859"
            },
            {
              "name": "[oss-security] 20160526 Re: Fwd: CVE for PHP 5.5.36 issues",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/05/26/3"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=72227",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=72227"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "DSA-3602",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3602"
            },
            {
              "name": "https://github.com/php/php-src/commit/7a1aac3343af85b4af4df5f8844946eaa27394ab?w=1",
              "refsource": "CONFIRM",
              "url": "https://github.com/php/php-src/commit/7a1aac3343af85b4af4df5f8844946eaa27394ab?w=1"
            },
            {
              "name": "https://github.com/libgd/libgd/commit/4f65a3e4eedaffa1efcf9ee1eb08f0b504fbc31a",
              "refsource": "CONFIRM",
              "url": "https://github.com/libgd/libgd/commit/4f65a3e4eedaffa1efcf9ee1eb08f0b504fbc31a"
            },
            {
              "name": "http://php.net/ChangeLog-5.php",
              "refsource": "CONFIRM",
              "url": "http://php.net/ChangeLog-5.php"
            },
            {
              "name": "http://php.net/ChangeLog-7.php",
              "refsource": "CONFIRM",
              "url": "http://php.net/ChangeLog-7.php"
            },
            {
              "name": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731",
              "refsource": "CONFIRM",
              "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05240731"
            },
            {
              "name": "DSA-3587",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2016/dsa-3587"
            },
            {
              "name": "USN-3030-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-3030-1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2013-7456",
    "datePublished": "2016-08-07T10:00:00.000Z",
    "dateReserved": "2016-05-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T18:09:17.049Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9767 (GCVE-0-2014-9767)

Vulnerability from cvelistv5 – Published: 2016-05-22 01:00 – Updated: 2024-08-06 13:55

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

14 references

URL	Tags
http://www.ubuntu.com/usn/USN-2952-1	vendor-advisoryx_refsource_UBUNTU
http://www.securitytracker.com/id/1035311	vdb-entryx_refsource_SECTRACK
https://bugs.php.net/bug.php?id=67996	x_refsource_CONFIRM
https://github.com/facebook/hhvm/commit/65c95a015…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/0…	mailing-listx_refsource_MLIST
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2952-2	vendor-advisoryx_refsource_UBUNTU
http://php.net/ChangeLog-5.php	x_refsource_CONFIRM
http://www.securityfocus.com/bid/76652	vdb-entryx_refsource_BID
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
https://bugs.php.net/bug.php?id=70350	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE

Date Public

2014-09-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:55:04.235Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-2952-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2952-1"
          },
          {
            "name": "1035311",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035311"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=67996"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686"
          },
          {
            "name": "[oss-security] 20160316 Re: Three CVE requests for PHP",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/16/20"
          },
          {
            "name": "openSUSE-SU-2016:1173",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "name": "SUSE-SU-2016:1166",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html"
          },
          {
            "name": "USN-2952-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2952-2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://php.net/ChangeLog-5.php"
          },
          {
            "name": "76652",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/76652"
          },
          {
            "name": "openSUSE-SU-2016:1167",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.php.net/bug.php?id=70350"
          },
          {
            "name": "SUSE-SU-2016:1145",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-09-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-2952-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2952-1"
        },
        {
          "name": "1035311",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1035311"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=67996"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686"
        },
        {
          "name": "[oss-security] 20160316 Re: Three CVE requests for PHP",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/16/20"
        },
        {
          "name": "openSUSE-SU-2016:1173",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "name": "SUSE-SU-2016:1166",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html"
        },
        {
          "name": "USN-2952-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2952-2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://php.net/ChangeLog-5.php"
        },
        {
          "name": "76652",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/76652"
        },
        {
          "name": "openSUSE-SU-2016:1167",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.php.net/bug.php?id=70350"
        },
        {
          "name": "SUSE-SU-2016:1145",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9767",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-2952-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2952-1"
            },
            {
              "name": "1035311",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1035311"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=67996",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=67996"
            },
            {
              "name": "https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686",
              "refsource": "CONFIRM",
              "url": "https://github.com/facebook/hhvm/commit/65c95a01541dd2fbc9c978ac53bed235b5376686"
            },
            {
              "name": "[oss-security] 20160316 Re: Three CVE requests for PHP",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2016/03/16/20"
            },
            {
              "name": "openSUSE-SU-2016:1173",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00058.html"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "SUSE-SU-2016:1166",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00056.html"
            },
            {
              "name": "USN-2952-2",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2952-2"
            },
            {
              "name": "http://php.net/ChangeLog-5.php",
              "refsource": "CONFIRM",
              "url": "http://php.net/ChangeLog-5.php"
            },
            {
              "name": "76652",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/76652"
            },
            {
              "name": "openSUSE-SU-2016:1167",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00057.html"
            },
            {
              "name": "https://bugs.php.net/bug.php?id=70350",
              "refsource": "CONFIRM",
              "url": "https://bugs.php.net/bug.php?id=70350"
            },
            {
              "name": "SUSE-SU-2016:1145",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00052.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9767",
    "datePublished": "2016-05-22T01:00:00.000Z",
    "dateReserved": "2016-03-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:55:04.235Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2325 (GCVE-0-2015-2325)

Vulnerability from cvelistv5 – Published: 2020-01-14 16:46 – Updated: 2024-08-06 05:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
http://lists.opensuse.org/opensuse-updates/2015-0…	x_refsource_MISC
https://bugs.exim.org/show_bug.cgi?id=1591	x_refsource_MISC
https://www.pcre.org/original/changelog.txt	x_refsource_CONFIRM
https://fortiguard.com/zeroday/FG-VD-15-015	x_refsource_MISC

Date Public

2015-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:15.978Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1591"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.pcre.org/original/changelog.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://fortiguard.com/zeroday/FG-VD-15-015"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-14T16:46:55.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1591"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.pcre.org/original/changelog.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://fortiguard.com/zeroday/FG-VD-15-015"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2325",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html",
              "refsource": "MISC",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1591",
              "refsource": "MISC",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1591"
            },
            {
              "name": "https://www.pcre.org/original/changelog.txt",
              "refsource": "CONFIRM",
              "url": "https://www.pcre.org/original/changelog.txt"
            },
            {
              "name": "https://fortiguard.com/zeroday/FG-VD-15-015",
              "refsource": "MISC",
              "url": "https://fortiguard.com/zeroday/FG-VD-15-015"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2325",
    "datePublished": "2020-01-14T16:46:55.000Z",
    "dateReserved": "2015-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:10:15.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2326 (GCVE-0-2015-2326)

Vulnerability from cvelistv5 – Published: 2020-01-14 16:46 – Updated: 2024-08-06 05:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

4 references

URL	Tags
https://bugs.exim.org/show_bug.cgi?id=1592	x_refsource_MISC
http://lists.opensuse.org/opensuse-updates/2015-0…	x_refsource_MISC
https://www.pcre.org/original/changelog.txt	x_refsource_CONFIRM
https://fortiguard.com/zeroday/FG-VD-15-016	x_refsource_MISC

Date Public

2015-05-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:16.144Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1592"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.pcre.org/original/changelog.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://fortiguard.com/zeroday/FG-VD-15-016"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by \"((?+1)(\\1))/\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-14T16:46:57.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1592"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.pcre.org/original/changelog.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://fortiguard.com/zeroday/FG-VD-15-016"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2326",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by \"((?+1)(\\1))/\"."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1592",
              "refsource": "MISC",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1592"
            },
            {
              "name": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html",
              "refsource": "MISC",
              "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00014.html"
            },
            {
              "name": "https://www.pcre.org/original/changelog.txt",
              "refsource": "CONFIRM",
              "url": "https://www.pcre.org/original/changelog.txt"
            },
            {
              "name": "https://fortiguard.com/zeroday/FG-VD-15-016",
              "refsource": "MISC",
              "url": "https://fortiguard.com/zeroday/FG-VD-15-016"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2326",
    "datePublished": "2020-01-14T16:46:57.000Z",
    "dateReserved": "2015-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:10:16.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2327 (GCVE-0-2015-2327)

Vulnerability from cvelistv5 – Published: 2015-12-02 01:00 – Updated: 2024-08-06 05:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

7 references

URL	Tags
http://www.openwall.com/lists/oss-security/2015/11/29/1	mailing-listx_refsource_MLIST
http://www.fortiguard.com/advisory/FG-VD-15-010/	x_refsource_MISC
http://www.securityfocus.com/bid/74924	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
https://bugs.exim.org/show_bug.cgi?id=1503	x_refsource_CONFIRM
https://jira.mongodb.org/browse/SERVER-17252	x_refsource_CONFIRM
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?vie…	x_refsource_CONFIRM

Date Public

2015-11-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:16.164Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.fortiguard.com/advisory/FG-VD-15-010/"
          },
          {
            "name": "74924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74924"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1503"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/SERVER-17252"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PCRE before 8.36 mishandles the /(((a\\2)|(a*)\\g\u003c-1\u003e))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.fortiguard.com/advisory/FG-VD-15-010/"
        },
        {
          "name": "74924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74924"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1503"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://jira.mongodb.org/browse/SERVER-17252"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2327",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PCRE before 8.36 mishandles the /(((a\\2)|(a*)\\g\u003c-1\u003e))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
            },
            {
              "name": "http://www.fortiguard.com/advisory/FG-VD-15-010/",
              "refsource": "MISC",
              "url": "http://www.fortiguard.com/advisory/FG-VD-15-010/"
            },
            {
              "name": "74924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74924"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1503",
              "refsource": "CONFIRM",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1503"
            },
            {
              "name": "https://jira.mongodb.org/browse/SERVER-17252",
              "refsource": "CONFIRM",
              "url": "https://jira.mongodb.org/browse/SERVER-17252"
            },
            {
              "name": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "refsource": "CONFIRM",
              "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2327",
    "datePublished": "2015-12-02T01:00:00.000Z",
    "dateReserved": "2015-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:10:16.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-2328 (GCVE-0-2015-2328)

Vulnerability from cvelistv5 – Published: 2015-12-02 01:00 – Updated: 2024-08-06 05:10

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

10 references

URL	Tags
http://www.openwall.com/lists/oss-security/2015/11/29/1	mailing-listx_refsource_MLIST
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=isg…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-1025.html	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/74924	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
http://www.fortiguard.com/advisory/FG-VD-15-014/	x_refsource_MISC
https://jira.mongodb.org/browse/SERVER-17252	x_refsource_CONFIRM
https://bugs.exim.org/show_bug.cgi?id=1515	x_refsource_CONFIRM
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?vie…	x_refsource_CONFIRM

Date Public

2015-11-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:10:16.260Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
          },
          {
            "name": "RHSA-2016:1025",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
          },
          {
            "name": "74924",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74924"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.fortiguard.com/advisory/FG-VD-15-014/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://jira.mongodb.org/browse/SERVER-17252"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1515"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-11-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
        },
        {
          "name": "RHSA-2016:1025",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
        },
        {
          "name": "74924",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74924"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.fortiguard.com/advisory/FG-VD-15-014/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://jira.mongodb.org/browse/SERVER-17252"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1515"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-2328",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[oss-security] 20151128 Re: Heap Overflow in PCRE",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/11/29/1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
            },
            {
              "name": "RHSA-2016:1025",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
            },
            {
              "name": "74924",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74924"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "http://www.fortiguard.com/advisory/FG-VD-15-014/",
              "refsource": "MISC",
              "url": "http://www.fortiguard.com/advisory/FG-VD-15-014/"
            },
            {
              "name": "https://jira.mongodb.org/browse/SERVER-17252",
              "refsource": "CONFIRM",
              "url": "https://jira.mongodb.org/browse/SERVER-17252"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1515",
              "refsource": "CONFIRM",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1515"
            },
            {
              "name": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup",
              "refsource": "CONFIRM",
              "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?view=markup"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-2328",
    "datePublished": "2015-12-02T01:00:00.000Z",
    "dateReserved": "2015-03-18T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:10:16.260Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3210 (GCVE-0-2015-3210)

Vulnerability from cvelistv5 – Published: 2016-12-13 16:00 – Updated: 2024-08-06 05:39

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2016:1132	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/bid/74934	vdb-entryx_refsource_BID
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2015/06/01/7	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2015/1…	mailing-listx_refsource_MLIST
https://bugs.exim.org/show_bug.cgi?id=1636	x_refsource_CONFIRM

Date Public

2015-05-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:39:31.991Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:1132",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1132"
          },
          {
            "name": "74934",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/74934"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "name": "[oss-security] 20150601 CVE-2015-3210: PCRE Library Heap Overflow Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/06/01/7"
          },
          {
            "name": "[oss-security] 20151202 Re: Heap Overflow in PCRE",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/12/02/11"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1636"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-05-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P\u003cB\u003ec)(?P\u003cB\u003ea(?P=B)))\u003eWGXCREDITS)/, a different vulnerability than CVE-2015-8384."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:1132",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1132"
        },
        {
          "name": "74934",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/74934"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "name": "[oss-security] 20150601 CVE-2015-3210: PCRE Library Heap Overflow Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/06/01/7"
        },
        {
          "name": "[oss-security] 20151202 Re: Heap Overflow in PCRE",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/12/02/11"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1636"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-3210",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular expression, as demonstrated by /^(?P=B)((?P=B)(?J:(?P\u003cB\u003ec)(?P\u003cB\u003ea(?P=B)))\u003eWGXCREDITS)/, a different vulnerability than CVE-2015-8384."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:1132",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:1132"
            },
            {
              "name": "74934",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/74934"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "[oss-security] 20150601 CVE-2015-3210: PCRE Library Heap Overflow Vulnerability",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/06/01/7"
            },
            {
              "name": "[oss-security] 20151202 Re: Heap Overflow in PCRE",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/12/02/11"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1636",
              "refsource": "CONFIRM",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1636"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-3210",
    "datePublished": "2016-12-13T16:00:00.000Z",
    "dateReserved": "2015-04-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:39:31.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-3217 (GCVE-0-2015-3217)

Vulnerability from cvelistv5 – Published: 2016-12-13 16:00 – Updated: 2024-08-06 05:39

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

10 references

URL	Tags
https://access.redhat.com/errata/RHSA-2016:1132	vendor-advisoryx_refsource_REDHAT
http://vcs.pcre.org/pcre?view=revision&revision=1566	x_refsource_CONFIRM
https://bugs.exim.org/show_bug.cgi?id=1638	x_refsource_CONFIRM
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2015/06/03/7	mailing-listx_refsource_MLIST
http://www-01.ibm.com/support/docview.wss?uid=isg…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-1025.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=1228283	x_refsource_CONFIRM
http://www.securityfocus.com/bid/75018	vdb-entryx_refsource_BID

Date Public

2015-06-03 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:39:31.985Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2016:1132",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1132"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1566"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1638"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
          },
          {
            "name": "[oss-security] 20150603 CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/06/03/7"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
          },
          {
            "name": "RHSA-2016:1025",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1228283"
          },
          {
            "name": "75018",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75018"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-17T16:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2016:1132",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1132"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1566"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1638"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
        },
        {
          "name": "[oss-security] 20150603 CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/06/03/7"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
        },
        {
          "name": "RHSA-2016:1025",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1228283"
        },
        {
          "name": "75018",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75018"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2015-3217",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of service (stack-based buffer overflow) via a crafted regular expression, as demonstrated by /^(?:(?(1)\\\\.|([^\\\\\\\\W_])?)+)+$/."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2016:1132",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:1132"
            },
            {
              "name": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1566",
              "refsource": "CONFIRM",
              "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1566"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1638",
              "refsource": "CONFIRM",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1638"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
            },
            {
              "name": "[oss-security] 20150603 CVE-2015-3217: PCRE Library Call Stack Overflow Vulnerability in match()",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/06/03/7"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
            },
            {
              "name": "RHSA-2016:1025",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1228283",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1228283"
            },
            {
              "name": "75018",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75018"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2015-3217",
    "datePublished": "2016-12-13T16:00:00.000Z",
    "dateReserved": "2015-04-10T00:00:00.000Z",
    "dateUpdated": "2024-08-06T05:39:31.985Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2015-5073 (GCVE-0-2015-5073)

Vulnerability from cvelistv5 – Published: 2016-12-13 16:00 – Updated: 2024-08-06 06:32

Summary

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

13 references

URL	Tags
http://www.securityfocus.com/bid/75430	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2016:1132	vendor-advisoryx_refsource_REDHAT
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://www-01.ibm.com/support/docview.wss?uid=isg…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2016-1025.html	vendor-advisoryx_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2016-2750.html	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2015/06/26/1	mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2015/06/26/3	mailing-listx_refsource_MLIST
https://bugs.exim.org/show_bug.cgi?id=1651	x_refsource_CONFIRM
http://www.securitytracker.com/id/1033154	vdb-entryx_refsource_SECTRACK
http://vcs.pcre.org/pcre/code/trunk/ChangeLog?rev…	x_refsource_CONFIRM
http://vcs.pcre.org/pcre?view=revision&revision=1571	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201607-02	vendor-advisoryx_refsource_GENTOO

Date Public

2015-06-26 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T06:32:32.687Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "75430",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75430"
          },
          {
            "name": "RHSA-2016:1132",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1132"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
          },
          {
            "name": "RHSA-2016:1025",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
          },
          {
            "name": "RHSA-2016:2750",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
          },
          {
            "name": "[oss-security] 20150626 CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/06/26/1"
          },
          {
            "name": "[oss-security] 20150626 Re: CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2015/06/26/3"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.exim.org/show_bug.cgi?id=1651"
          },
          {
            "name": "1033154",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1033154"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609\u0026view=markup"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1571"
          },
          {
            "name": "GLSA-201607-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201607-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-17T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "75430",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75430"
        },
        {
          "name": "RHSA-2016:1132",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1132"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
        },
        {
          "name": "RHSA-2016:1025",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
        },
        {
          "name": "RHSA-2016:2750",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
        },
        {
          "name": "[oss-security] 20150626 CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/06/26/1"
        },
        {
          "name": "[oss-security] 20150626 Re: CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2015/06/26/3"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.exim.org/show_bug.cgi?id=1651"
        },
        {
          "name": "1033154",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1033154"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609\u0026view=markup"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1571"
        },
        {
          "name": "GLSA-201607-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201607-02"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2015-5073",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the find_fixedlength function in pcre_compile.c in PCRE before 8.38 allows remote attackers to cause a denial of service (crash) or obtain sensitive information from heap memory and possibly bypass the ASLR protection mechanism via a crafted regular expression with an excess closing parenthesis."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "75430",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75430"
            },
            {
              "name": "RHSA-2016:1132",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2016:1132"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=isg3T1023886"
            },
            {
              "name": "RHSA-2016:1025",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-1025.html"
            },
            {
              "name": "RHSA-2016:2750",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2750.html"
            },
            {
              "name": "[oss-security] 20150626 CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/06/26/1"
            },
            {
              "name": "[oss-security] 20150626 Re: CVE Request: PCRE Library Heap Overflow Vulnerability in find_fixedlength()",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2015/06/26/3"
            },
            {
              "name": "https://bugs.exim.org/show_bug.cgi?id=1651",
              "refsource": "CONFIRM",
              "url": "https://bugs.exim.org/show_bug.cgi?id=1651"
            },
            {
              "name": "1033154",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1033154"
            },
            {
              "name": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609\u0026view=markup",
              "refsource": "CONFIRM",
              "url": "http://vcs.pcre.org/pcre/code/trunk/ChangeLog?revision=1609\u0026view=markup"
            },
            {
              "name": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1571",
              "refsource": "CONFIRM",
              "url": "http://vcs.pcre.org/pcre?view=revision\u0026revision=1571"
            },
            {
              "name": "GLSA-201607-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201607-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2015-5073",
    "datePublished": "2016-12-13T16:00:00.000Z",
    "dateReserved": "2015-06-26T00:00:00.000Z",
    "dateUpdated": "2024-08-06T06:32:32.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2016:2750

BDU:2017-01772 (CVE-2016-4473)

CVE-2013-7456 (GCVE-0-2013-7456)

CVE-2014-9767 (GCVE-0-2014-9767)

CVE-2015-2325 (GCVE-0-2015-2325)

CVE-2015-2326 (GCVE-0-2015-2326)

CVE-2015-2327 (GCVE-0-2015-2327)

CVE-2015-2328 (GCVE-0-2015-2328)

CVE-2015-3210 (GCVE-0-2015-3210)

CVE-2015-3217 (GCVE-0-2015-3217)

CVE-2015-5073 (GCVE-0-2015-5073)

Tags

Sightings

Nomenclature

Related by attack behaviour