CVE Vulnerability Catalog

The zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data containing a ZipArchive object.

A double free vulnerability in the php_wddx_process_data function in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted XML data that is mishandled in a wddx_deserialize call.

In spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23, there is an improper interaction with the unserialize implementation and garbage collection, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.

Integer overflow in the SplFileObject::fread function in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument.

Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted length value, related to the mcrypt_generic and mdecrypt_generic functions.

A double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by leveraging a callback exception.

Integer overflow in the gdImageCreate function in the GD Graphics Library before version 2.0.34RC1, used in PHP before versions 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted image dimensions.

Integer overflow in the _gd2GetHeader function in the GD Graphics Library (libgd) before version 2.2.3, as used in PHP before version 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via crafted chunk dimensions in an image.

In the GD Graphics Library (libgd) before version 2.2.0, there is a vulnerability that allows attackers to obtain sensitive information from process memory or cause application crashes via a long name.

In PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2, there is a flaw in fpm_log.c that misinterprets the return value of snprintf. This can lead to the disclosure of sensitive information from process memory or denial of service via out-of-bounds read and buffer overflow.

Integer overflow in the fread function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.

Integer overflow in the php_escape_html_entities_ex function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from a FILTER_SANITIZE_FULL_SPECIAL_CHARS filter_var call.

Integer overflow in the php_html_entities function in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.

The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.

A double free vulnerability in the SplDoublyLinkedList::offsetSet function in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.

Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.

In the GD Graphics Library (libgd) before version 2.1.1, used in PHP before version 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, there is a vulnerability that allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image mishandled by the imagescale function.

A race condition in the ioctl_file_dedupe_range function in the Linux kernel through version 4.7 allows local users to cause a denial of service (heap-based buffer overflow) or possibly gain privileges by changing a certain count value, known as a 'double fetch' vulnerability.

The apparmor_setprocattr function in the Linux kernel before version 4.6.5 does not validate the buffer size, allowing local users to gain privileges by triggering an AppArmor setprocattr hook.

The Linux kernel in version 4.7-rc6 has a vulnerability that allows local users to cause a denial of service (panic) or potentially have unspecified other impact via certain IPv6 socket operations.