PHP vulnerabilities

In PHP (versions 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9), improper escaping of backslashes in attacker-supplied parameters allows trivial SQL injection.

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same length. This can lead to out-of-bounds read of global memory, potentially causing a crash or information disclosure.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, when SOAP requests result in an error, persistence is handled incorrectly, freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, impacting confidentiality, integrity, and availability.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.

In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar files, insufficient length checking may lead to a stack buffer overflow, potentially resulting in memory corruption or RCE.

In PHP, the EXIF extension parsing EXIF information from an image (e.g., via exif_read_data()) in versions 7.2.x below 7.2.26, 7.3.x below 7.3.13, and 7.4.0 can read past the allocated buffer, potentially leading to information disclosure or crash.

In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to the mail() function, if the header is supplied in lowercase, it can result in double-freeing certain memory locations.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, the DirectoryIterator class accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g., in applications checking paths that the code is allowed to access.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0 on Windows, the link() function accepts filenames with embedded \0 byte and treats them as terminating at that byte. This could lead to security vulnerabilities, e.g., in applications checking paths that the code is allowed to access.

The finish_nested_data function in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can impact the integrity of PHP.

In PHP versions 7.0.x through 7.0.22 and 7.1.x through 7.1.8, there is a vulnerability related to heap use after free when unserializing untrusted data. This issue is related to improper use of the hash API for key deletion in a situation with an invalid array size.

The i_zval_ptr_dtor function in Zend/zend_variables.h in PHP 7.1.5 allows attackers to cause a denial of service (memory consumption and application crash) by triggering crafted operations on array data structures.

The zend_string_extend function in PHP through version 7.1.5 does not prevent changes to string objects that can lead to negative length. This allows remote attackers to cause application crashes or potentially other unspecified impacts by leveraging the .= operator with a long string.

Off-by-one error in the phar_parse_pharfile function in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

All versions of PHP 7 have a vulnerability that during the unserialization process may lead to use-after-free when resizing the 'properties' hash table of a serialized object. A remote attacker may exploit this bug to gain arbitrary code execution.

The SplObjectStorage unserialize implementation in PHP before 7.0.12 does not verify that a key is an object, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

In PHP before 5.6.26 and 7.x before 7.0.11, there is a vulnerability in ext/spl/spl_array.c that allows SplArray unserialization without validating a return value and data type. This can lead to denial of service or possibly unspecified other impacts via crafted serialized data.

The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, allowing remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive.

In PHP before version 5.6.26, there is an issue with handling object-deserialization failures, which can lead to denial of service due to memory corruption or other unspecified impacts.

The imagegammacorrect function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which can lead to denial of service (out-of-bounds write) or other unspecified impacts.

The imagetruecolortopalette function in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which may lead to denial of service or other unspecified impacts.

In PHP before 5.6.25 and 7.x before 7.0.10, there is an issue with mishandling certain invalid objects, which may lead to denial of service or other unspecified impacts. Attackers can exploit crafted serialized data, leading to a __destruct call or magic method call.

In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.

In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an improper interaction between the unserialize implementation and garbage collection, which may allow remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data.

The locale_accept_from_http function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

The exif_process_IFD_in_MAKERNOTE function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service via out-of-bounds array access and memory corruption. Attackers may also obtain sensitive information from process memory or possibly have unspecified other impact via a crafted JPEG image.

In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an issue with improper maintenance of a certain hash data structure, which can lead to denial of service (use-after-free) or possibly unspecified other impacts related to session deserialization.

The php_url_parse_ex function in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via vectors involving the smart_str data type.

The exif_process_TIFF_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

The exif_process_IFD_in_JPEG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

The exif_process_IFD_TAG function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, allowing remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

The grapheme_strpos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

The grapheme_stripos function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.

The xml_parse_into_struct function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service through crafted XML data, leading to parser errors.

The bcpowmod function in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which may lead to denial of service or other unspecified impacts.

Integer overflow in the str_pad function in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.

Integer overflow in the xml_utf8_encode function in PHP before version 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long argument to the utf8_encode function, leading to a heap-based buffer overflow.

In PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12, certain Exception objects are not validated, allowing remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted session content.

Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code. These issues are related to the Serializable interface, the SplObjectStorage class, and the SplDoublyLinkedList class, which are mishandled during unserialization.

The phar_convert_to_other function in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive mishandled in a Phar::convertToData call.

Heap-based buffer overflow in the ftp_genlist function in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command.

The exception::getTraceAsString function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

The __PHP_Incomplete_Class function in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

PHP versions before 5.6.7 may allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues.

The SoapFault::__toString method in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.

The gdImageRotateInterpolated function in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service via a large bgd_color argument to the imagerotate function.