SB2018101525 - Multiple vulnerabilities in PHP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101525

SB2018101525 - Multiple vulnerabilities in PHP

Published: October 15, 2018 Updated: June 13, 2025

Security Bulletin ID SB2018101525
Severity
Medium
Patch available
YES
Number of vulnerabilities 18
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 18 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2007-4784)

The vulnerability allows context-dependent attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (application crash) via a long string in the locale parameter.


2) Input validation error (CVE-ID: CVE-2007-4670)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Unspecified vulnerability in PHP before 5.2.4 has unknown impact and attack vectors, related to an "Improved fix for MOPB-03-2007," probably a variant of CVE-2007-1285.


3) Input validation error (CVE-ID: CVE-2007-4657)

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can obtain sensitive information (memory contents) or cause a denial of service (thread crash) via a large len value to the (1) strspn or (2) strcspn function, which triggers an out-of-bounds read.


4) Input validation error (CVE-ID: CVE-2007-4659)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The zend_alter_ini_entry function in PHP before 5.2.4 does not properly handle an interruption to the flow of execution triggered by a memory_limit violation, which has unknown impact and attack vectors.


5) Resource management error (CVE-ID: CVE-2007-4660)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Unspecified vulnerability in the chunk_split function in PHP before 5.2.4 has unknown impact and attack vectors, related to an incorrect size calculation.


6) Heap-based buffer overflow (CVE-ID: CVE-2007-4661)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the chunk_split function in string.c in PHP 5.2.3 does not properly calculate the needed buffer size due to precision loss when performing integer arithmetic with floating point numbers, which. A remote attacker can trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


7) Buffer overflow (CVE-ID: CVE-2007-4662)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the php_openssl_make_REQ function in PHP before 5.2.4 has unknown impact and attack vectors.


8) Path traversal (CVE-ID: CVE-2007-4663)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in PHP before 5.2.4. A remote authenticated attacker can send a specially crafted HTTP request and attackers to bypass open_basedir restrictions via unspecified vectors involving the glob function.


9) Input validation error (CVE-ID: CVE-2007-3996)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.


10) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2007-3997)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The (1) MySQL and (2) MySQLi extensions in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, allow remote attackers to bypass safe_mode and open_basedir restrictions via MySQL LOCAL INFILE operations, as demonstrated by a query with LOAD DATA LOCAL INFILE.


11) Improper input validation (CVE-ID: CVE-2007-3998)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The wordwrap function in PHP 4 before 4.4.8, and PHP 5 before 5.2.4, does not properly use the breakcharlen variable, which allows remote attackers to cause a denial of service (divide-by-zero error and application crash, or infinite loop) via certain arguments, as demonstrated by a 'chr(0), 0, ''' argument set.


12) Input validation error (CVE-ID: CVE-2007-4507)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple buffer overflows in the php_ntuser component for PHP 5.2.3 allow context-dependent attackers to cause a denial of service or execute arbitrary code via long arguments to the (1) ntuser_getuserlist, (2) ntuser_getuserinfo, (3) ntuser_getusergroups, or (4) ntuser_getdomaincontroller functions.


13) Input validation error (CVE-ID: CVE-2007-4255)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to the msql_connect function.


14) Buffer overflow (CVE-ID: CVE-2007-4033)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.


15) Input validation error (CVE-ID: CVE-2007-4010)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.


16) Input validation error (CVE-ID: CVE-2007-3806)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.


17) Input validation error (CVE-ID: CVE-2007-3790)

The vulnerability allows a remote non-authenticated attacker to manipulate or delete data.

The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long argument.


18) Buffer overflow (CVE-ID: CVE-2007-3294)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple buffer overflows in libtidy, as used in the Tidy extension for PHP 5.2.3 and possibly other products, allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the tidy_repair_string function. NOTE: this might only be an issue in environments where vsnprintf is implemented as a wrapper for vsprintf.


Remediation

Install update from vendor's website.

References