SB2018101124 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101124

SB2018101124 - Multiple vulnerabilities in PHP

Published: October 11, 2018 Updated: June 11, 2025

Security Bulletin ID SB2018101124
Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 23% Medium 69% Low 8%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2008-2107)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 32-bit systems, performs a multiplication using values that can produce a zero seed in rare circumstances, which allows context-dependent attackers to predict subsequent values of the rand and mt_rand functions and possibly bypass protection mechanisms that rely on an unknown initial seed.


2) Insufficient Entropy (CVE-ID: CVE-2008-2108)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The GENERATE_SEED macro in PHP 4.x before 4.4.8 and 5.x before 5.2.5, when running on 64-bit systems, performs a multiplication that generates a portion of zero bits during conversion due to insufficient precision, which produces 24 bits of entropy and simplifies brute force attacks against protection mechanisms that use the rand and mt_rand functions.


3) Buffer overflow (CVE-ID: CVE-2008-2050)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.


4) Input validation error (CVE-ID: CVE-2008-2051)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."


5) Information disclosure (CVE-ID: CVE-2007-5899)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The output_add_rewrite_var function in PHP before 5.2.5 rewrites local forms in which the ACTION attribute references a non-local URL, which allows remote attackers to obtain potentially sensitive information by reading the requests for this URL, as demonstrated by a rewritten form containing a local session ID.


6) Input validation error (CVE-ID: CVE-2007-5898)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The (1) htmlentities and (2) htmlspecialchars functions in PHP before 5.2.5 accept partial multibyte sequences, which has unknown impact and attack vectors, a different issue than CVE-2006-5465.


7) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-5900)

The vulnerability allows a local user to execute arbitrary code.

PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.


8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-5447)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.


9) Input validation error (CVE-ID: CVE-2007-4889)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The MySQL extension in PHP 5.2.4 and earlier allows remote attackers to bypass safe_mode and open_basedir restrictions via the MySQL (1) LOAD_FILE, (2) INTO DUMPFILE, and (3) INTO OUTFILE functions, a different issue than CVE-2007-3997.


10) Input validation error (CVE-ID: CVE-2007-4887)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via a long string in the library parameter.


11) Input validation error (CVE-ID: CVE-2007-4840)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function.


12) Path traversal (CVE-ID: CVE-2007-4825)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in PHP 5.2.4 and earlier. A remote authenticated attacker can send a specially crafted HTTP request and attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a . (dot dot) in the dl function.


13) Input validation error (CVE-ID: CVE-2007-4783)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter.


Remediation

Install update from vendor's website.

References