SB2016091215 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016091215

SB2016091215 - Multiple vulnerabilities in PHP

Published: September 12, 2016 Updated: August 9, 2020

Security Bulletin ID SB2016091215
Severity
High
Patch available
NO
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 44% Medium 56%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) Integer overflow (CVE-ID: CVE-2016-7133)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedir is enabled, mishandles huge realloc operations, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a long pathname.


2) NULL pointer dereference (CVE-ID: CVE-2016-7132)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.


3) NULL pointer dereference (CVE-ID: CVE-2016-7131)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.


4) NULL pointer dereference (CVE-ID: CVE-2016-7130)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via an invalid base64 binary value, as demonstrated by a wddx_deserialize call that mishandles a binary element in a wddxPacket XML document.


5) Input validation error (CVE-ID: CVE-2016-7129)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via an invalid ISO 8601 time value, as demonstrated by a wddx_deserialize call that mishandles a dateTime element in a wddxPacket XML document.


6) Information disclosure (CVE-ID: CVE-2016-7128)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.


7) Out-of-bounds write (CVE-ID: CVE-2016-7127)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by providing different signs for the second and third arguments.


8) Out-of-bounds write (CVE-ID: CVE-2016-7126)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to cause a denial of service (select_colors allocation error and out-of-bounds write) or possibly have unspecified other impact via a large value in the third argument.


9) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2016-7125)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbitrary-type session data by leveraging control of a session name, as demonstrated by object injection.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References