Known vulnerabilities in PHP 5.4.2

Vendor: PHP Group
Software: PHP
Version: 5.4.2
Software CPE: cpe:2.3:a:php_group:php:*:*:*:*:*:*:*:*
Total vulnerabilities: 35
Public exploits: 7
Known exploited (KEV): 1
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting PHP version 5.4.2 PHP 5.4.2 is affected by 35 vulnerabilities: 4 critical, 3 high, 19 medium, 9 low Critical High Medium Low

Vulnerabilities (35)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU91106 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-4577
CWE-78 Critical
Public exploit available
Exploited
8.1.29, 8.2.20, 8.3.8 04.06.2024 SB2024060501
SB2024060502
SB2024060503
and 12 more
#VU74185 - Memory corruption
CVE-2022-4900
CWE-119 Low
No
No
8.0.22, 8.1.9 30.03.2023 SB2023033010
SB2023033014
SB2023041468
and 4 more
#VU110277 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2013-1824
CWE-611 Medium
No
No
5.4.12 13.02.2023 SB2023021350
SB2014082910
#VU110272 - Improper input validation
CVE-2015-8873
CWE-20 Medium
No
No
5.4.44 05.11.2022 SB2016051609
#VU57656 - Out-of-bounds write
CVE-2021-21703
CWE-787 Low
No
No
7.4.25, 8.0.12 26.10.2021 SB2021102621
SB2021102719
SB2022012745
and 20 more
#VU35071 - Improper input validation
CVE-2010-4657
CWE-20 Medium
No
No
5.4.4 13.11.2019 SB2019111362
#VU16140 - Improper Control of Generation of Code ('Code Injection')
CVE-2015-8835
CWE-94 Medium
No
No
5.4.44, 5.5.28, 5.6.12 28.11.2018 SB2016051609
#VU16139 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2014-9767
CWE-22 Low
No
No
5.4.45, 5.5.29, 5.6.13 28.11.2018 SB2016052201
#VU10880 - Resource exhaustion
CVE-2015-9253
CWE-400 Low
No
No
- 07.03.2018 SB2018021618
SB2018091805
SB2020021722
and 3 more
#VU8965 - Out-of-bounds read
CVE-2017-11145
CWE-125 Low
No
No
- 27.10.2017 SB2017102708
SB2017121805
SB2018011105
and 2 more
#VU7685 - Missing release of memory after effective lifetime
CWE-401 Low
No
No
- 03.08.2017 SB2017080312
#VU7684 - Integer overflow
CWE-190 High
No
No
- 03.08.2017 SB2017080312
#VU7683 - Use After Free
CWE-416 Low
No
No
- 03.08.2017 SB2017080312
#VU39590 - Permissions, Privileges, and Access Controls
CVE-2015-8994
CWE-264 Medium
No
No
- 02.03.2017 SB2017030206
#VU1001 - Use After Free
CVE-2015-6835
CWE-416 High
Public exploit available
No
- 14.10.2016 SB2016092303
#VU32405 - Improper input validation
CVE-2015-5589
CWE-20 High
No
No
5.4.43, 5.5.27, 5.6.11 16.05.2016 SB2016051610
SB2015072806
SB2015081704
and 3 more
#VU32406 - Stack-based buffer overflow
CVE-2015-5590
CWE-121 Medium
No
No
5.4.43, 5.5.27, 5.6.11 19.01.2016 SB2016011911
SB2015072807
SB2015081704
and 3 more
#VU10333 - UNIX Symbolic Link (Symlink) Following
CVE-2014-5459
CWE-61 Low
No
No
- 27.09.2014 SB2014082701
#VU32501 - Improper input validation
CVE-2014-5120
CWE-20 Medium
No
No
5.4.32 23.08.2014 SB2014082301
SB2014090112
SB2014091920
and 2 more
#VU32500 - Improper input validation
CVE-2014-3538
CWE-20 Medium
No
No
- 03.07.2014 SB2014070302
SB2014072101
SB2014072102
and 2 more


Showing elements 1 - 20 out of 35