PHP — популярный язык сценариев общего назначения, особенно подходящий для веб-разработки.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to "type confusion" issues in (1) ArrayObject and (2) SPLObjectStorage.

The cdf_read_short_sector function in cdf.c in file before 5.19, as us ...

The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorre ...

The cdf_read_property_info function in file before 5.19, as used in th ...

The cdf_count_chain function in cdf.c in file before 5.19, as used in ...

The cdf_check_stream_offset function in cdf.c in file before 5.19, as ...

Buffer overflow in the mconvert function in softmagic.c in file before ...

The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.

The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.