PHP 7.x before 7.0.1 vulnerabilities

Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the php_escape_shell_cmd or php_escape_shell_arg function, leading to a heap-based buffer overflow.

A use-after-free vulnerability in the Collator::sortWithSortKeys function in PHP 7.x before version 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.

The php_str_replace_in_subject function in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.

The unserialize implementation in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.

A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

A double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to trigger an error, potentially leading to unspecified impact.

CVE-2015-8617 describes a format string vulnerability in the zend_throw_or_error function in PHP 7.x before version 7.0.1. This allows remote attackers to execute arbitrary code via format string specifiers in a string misused as a class name, leading to incorrect error handling.