PHP — популярный язык сценариев общего назначения, особенно подходящий для веб-разработки.
Релизный цикл, информация об уязвимостях
График релизов
Количество 4 000
CVE-2015-8878
main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5 ...
CVE-2015-8877
The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
CVE-2015-8877
The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graph ...
CVE-2015-8876
Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
CVE-2015-8876
Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and ...
CVE-2015-8867
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVE-2015-8867
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in P ...
CVE-2015-8866
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
CVE-2015-8866
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when ...
CVE-2014-9767
Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2015-8878 main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5 ... | CVSS3: 5.9 | 1% Низкий | около 10 лет назад |
 | CVE-2015-8877 The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function. | CVSS3: 7.5 | 4% Низкий | около 10 лет назад |
| CVE-2015-8877 The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graph ... | CVSS3: 7.5 | 4% Низкий | около 10 лет назад |
| CVE-2015-8876 Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data. | CVSS3: 9.8 | 8% Низкий | около 10 лет назад |
| CVE-2015-8876 Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and ... | CVSS3: 9.8 | 8% Низкий | около 10 лет назад |
| CVE-2015-8867 The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. | CVSS3: 7.5 | 4% Низкий | около 10 лет назад |
| CVE-2015-8867 The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in P ... | CVSS3: 7.5 | 4% Низкий | около 10 лет назад |
| CVE-2015-8866 ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161. | CVSS3: 9.6 | 4% Низкий | около 10 лет назад |
| CVE-2015-8866 ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when ... | CVSS3: 9.6 | 4% Низкий | около 10 лет назад |
| CVE-2014-9767 Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive. | CVSS3: 4.3 | 5% Низкий | около 10 лет назад |
Уязвимостей на страницу