Search CVE reports
161 – 170 of 290 results
The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.31 and 7.x before 7.1.7, does not zero colorMap arrays before use. A specially crafted GIF image...
4 affected packages
libgd2, php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| libgd2 | — | — | — | — | — |
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini_do_op() function in Zend/zend_ini_parser.c could cause a denial of service or potentially allow executing code. NOTE:...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 4 of 5
In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | Not in release |
| php7.0 | — | — | — | — | Not in release |
| php7.1 | — | — | — | — | Not in release |
In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related to main/php_variables.c.
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 1 of 2
In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 4 of 5
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter,...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 4 of 5
In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 1 of 2
In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
Some fixes available 1 of 2
In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as demonstrated...
3 affected packages
php5, php7.0, php7.1
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |
| php7.1 | — | — | — | — | — |
/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.
2 affected packages
php5, php7.0
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| php5 | — | — | — | — | — |
| php7.0 | — | — | — | — | — |