PHP vulnerabilities

This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.

This CVE has been rejected. Reason: Red Hat is not the CNA for PHP. CVE was reserved in error; the appropriate CNA should assign CVE IDs for these vulnerabilities.

PHP versions 7.0.x before 7.0.21 and 7.1.x before 7.1.7 are prone to a heap use after free while unserializing untrusted data. This issue is related to the zval_get_type function in Zend/zend_types.h.

In PHP versions before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function could lead to denial of service or potentially allow executing code. This issue is relevant for PHP applications that accept untrusted input for the parse_ini_string or parse_ini_file function.

In PHP versions before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a denial of service attack by injecting long form variables, leading to excessive CPU consumption.

The bzread function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (out-of-bounds write) or execute arbitrary code via a crafted bz2 archive.

The _zval_get_long_func_ex function in PHP 7.1.2 has a vulnerability that allows attackers to cause a denial of service through crafted use of 'declare(ticks=' in a PHP script, leading to a NULL pointer dereference and application crash.

PHP versions up to 7.1.11 enable potential SSRF attacks in applications that accept a hostname argument for fsockopen or pfsockopen, expecting the port number to be constrained. Due to the recognition of :port syntax, fsockopen will use the port number specified in the hostname argument instead of the port number in the second argument of the function.

The object_common1 function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.

The exif_convert_any_to_int function in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.

In PHP before 5.6.28 and 7.x before 7.0.13, a vulnerability allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document.

In PHP 7.x before 7.0.10, when open_basedir is enabled, there is an issue with handling huge realloc operations, which can lead to integer overflow and potentially cause a denial of service.

In PHP before version 5.6.25 and 7.x before 7.0.10, a vulnerability allows remote attackers to cause a denial of service through a malformed wddxPacket XML document. This leads to a NULL pointer dereference and application crash.

In PHP before 5.6.25 and 7.x before 7.0.10, there is a vulnerability that skips invalid session names, leading to incorrect parsing. This allows remote attackers to inject arbitrary session data by controlling a session name.

Integer overflow in the fread function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

Integer overflow in the php_escape_html_entities_ex function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call.

Integer overflow in the php_html_entities function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.

Integer overflow in the virtual_file_ex function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted extract operation on a ZIP archive.

PHP versions up to 7.0.8 do not address namespace conflicts as per RFC 3875, exposing applications to risks from untrusted client data in the HTTP_PROXY environment variable. This may allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header.

The phar_make_dirstream function in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which can lead to denial of service or other unspecified impacts via a crafted TAR archive.

In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, there is an issue with handling zero-length uncompressed data, which can lead to denial of service (heap memory corruption) or other unspecified impacts.

A stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.

The SoapClient::__call method in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, allowing remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type.

Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

The phar_parse_metadata function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

A use-after-free vulnerability in the process_nested_data function in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages the use of the unset function within an __wakeup function.

A use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier.

A heap-based buffer overflow in the enchant_broker_request_dict function in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Use-after-free vulnerability in the process_nested_data function in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object.

A use-after-free vulnerability in the process_nested_data function in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within the serialized properties of an object.

Vulnerability in PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14. A hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

Incomplete fix for CVE-2022-31629 in PHP. Network or same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, when using streams with a configured proxy and the request_fulluri option, the URI is not properly sanitized, which can lead to HTTP request smuggling and allow the attacker to perform arbitrary HTTP requests through the proxy.

Vulnerability in PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5. If a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() incorrectly returns true.

In PHP versions 8.3.x before 8.3.19 and 8.4.x before 8.4.5, a code sequence involving the __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability.

Logic error in PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8. Filtering functions like filter_var when validating URLs (FILTER_VALIDATE_URL) for certain URL types return invalid user information (username+password part of URLs).

Parsing error in multipart/form-data in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. Erroneous parsing can lead to legitimate data not being processed, and an attacker can control part of the submitted data.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is a limit on the location value size to 1024 bytes, which may be insufficient per RFC.

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

In PHP versions 8.1.x before 8.1.31, 8.2.x before 8.2.26, 8.3.x before 8.3.14, the convert.quoted-printable-decode filter can cause a buffer overread by one byte, potentially leading to crashes or disclosure of other memory areas.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, the HTTP request module incorrectly parses folded headers in HTTP responses, which may lead to misinterpreting the response and using incorrect MIME headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.

Vulnerability in PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12. The HTTP_REDIRECT_STATUS variable used to check if CGI is run by the HTTP server can be controlled by the request submitter via HTTP headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.

The bccomp() function in PHP (versions 8.4.x before 8.4.24 and 8.5.x before 8.5.9) improperly handles attacker-supplied input, which can lead to an out-of-bounds write and stack/heap corruption.