PHP vulnerabilities

CVE-2015-4116 is a use-after-free vulnerability in the spl_ptr_heap_insert function in PHP before 5.5.27 and 5.6.x before 5.6.11. It allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.

The gdImageRotateInterpolated function in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service via a large bgd_color argument to the imagerotate function.

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process. This affects PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

In the AES-WRAP-PAD algorithm implementation in the OpenSSL extension for PHP, there is a buffer allocation flaw. The output buffer size is determined from the plaintext length without accounting for RFC 5649 expansion, which may cause out-of-bounds memory writes.

Vulnerability in PHP (versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6) in the DOMNode::C14N() method causes incorrect XML processing, resulting in a circular linked list in the XML document's data structure. This may cause an infinite loop during subsequent processing, leading to denial of service (DoS).

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function uses a signed int variable to track the position in the input string. Passing a string longer than 2,147,483,647 bytes causes a signed integer overflow, leading to undefined behavior, out-of-bounds read, segmentation fault, and potential availability impact on the PHP process.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of a missing value element. This leads to dereferencing a NULL pointer, causing a segmentation fault, allowing a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference and denial of service. Exploitable when user input influences the encoding passed to mb_regex_encoding().

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, functions like urldecode() pass signed char to ctype functions (e.g., isxdigit()). On systems with default signed char and optimized table-lookup ctype functions (e.g., NetBSD), this can lead to array access with negative offset, potentially causing denial of service.

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, an attacker can craft a URL that causes arbitrary JavaScript execution (XSS) on the target's machine when viewing the PHP-FPM status page.

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params(). This may cause crashes (segmentation fault) and affect server availability.

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, and 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.

In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized, potentially leading to information disclosure of sensitive heap data and affecting the confidentiality of the target server.

In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, and 8.2.* before 8.2.7, when using SOAP HTTP Digest Authentication, the random value generator was not checked for failure and was using a narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server.

In PHP 8.0.x before 8.0.28, 8.1.x before 8.1.16, and 8.2.x before 8.2.3, the password_verify() function may accept some invalid Blowfish hashes as valid. If such an invalid hash ends up in the password database, it may allow any password for that entry to be considered valid.

In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, the bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the allocated space by supplying a string containing characters that are identified as numeric by the OS but aren't ASCII numbers. This can lead to disclosure of the content of some memory locations.

The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode. This can lead to unauthorized file access.