Skip to contentPhp vulnerabilities
Newest
- phpThe php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows...CVE-2015-65277.3 High
- phpThe gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5...CVE-2016-1903Fix available9.1 Critical
- pcre, fedoraproject fedora, oracle solaris +1 more +3 moreThe pcre_compile2 function in pcre_compile.c in PCRE 8.38 mishandles the /((?:F?+(?:^(?(R)a+\")...CVE-2016-1283Fix available9.8 Critical
- php, apple mac os x +1 moreThe file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in...CVE-2015-8865Fix available7.3 High
- phpext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a...CVE-2015-8838Fix available5.9 Medium
- phpThe make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5...CVE-2015-8835Fix available9.8 Critical
- pcre perl compatible regular expression library, php +1 morePCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote...CVE-2015-8394Fix available9.8 Critical
- fedoraproject fedora, pcre perl compatible regular expression library, php +2 morepcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote...CVE-2015-8393Fix available7.5 High
- pcre, fedoraproject fedora, oracle linux +7 more +9 moreThe pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting,...CVE-2015-8391Fix available9.8 Critical
- fedoraproject fedora, pcre perl compatible regular expression library, php +2 morePCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote...CVE-2015-8390Fix available9.8 Critical
- fedoraproject fedora, pcre perl compatible regular expression library, php +2 morePCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote...CVE-2015-8389Fix available9.8 Critical
- fedoraproject fedora, pcre perl compatible regular expression library, php +2 morePCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows...CVE-2015-8387Fix available7.3 High
- fedoraproject fedora, oracle linux, pcre perl compatible regular expression library +1 more +3 morePCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive...CVE-2015-8386Fix available9.8 Critical
- fedoraproject fedora, pcre perl compatible regular expression library, php +2 morePCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to...CVE-2015-8383Fix available9.8 Critical
- php, apple mac os x +1 moreOff-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5...CVE-2015-7804Fix available6.8 Medium
- php, apple mac os x +1 moreThe phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14...CVE-2015-7803Fix availableEPSS 10.3%6.8 Medium
- php, xmlsoft libxml2 +1 moreThe xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5...CVE-2015-6838Fix available7.5 High
- php, xmlsoft libxml2 +1 moreThe xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5...CVE-2015-6837Fix available7.5 High
- phpThe SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5...CVE-2015-6836Fix availableEPSS 10.3%7.3 High
- phpThe session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13...CVE-2015-6835Public exploitFix availableEPSS 36.2%9.8 Critical
- phpMultiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x...CVE-2015-6834Public exploitFix availableEPSS 46.8%9.8 Critical
- phpDirectory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28...CVE-2015-6833Fix available7.5 High
- phpUse-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP...CVE-2015-6832Fix available7.3 High
- php, debian linux +1 moreMultiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6...CVE-2015-6831Fix available7.3 High
- phpStack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5...CVE-2015-5590Fix available7.3 High
- phpThe phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5...CVE-2015-5589Fix available9.8 Critical
- mariadb, oracle mysql, debian linux +9 more +11 moreOracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and...CVE-2015-3152Public exploitFix available5.9 Medium
- phpThe escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and...CVE-2015-46429.8 Critical
- php, redhat enterprise linux, enterprise linux desktop +5 more +7 moreThe mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5...CVE-2015-46057.5 High
- php, redhat enterprise linux, enterprise linux desktop +5 more +7 moreThe mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4...CVE-2015-46047.5 High
- php, apple mac os x, redhat enterprise linux desktop +5 more +7 moreThe SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5...CVE-2015-4147Fix availableEPSS 12.2%7.5 High
- php, apple mac os x, redhat enterprise linux +6 more +8 moreThe phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24,...CVE-2015-33077.5 High
- php, apple mac os x, redhat enterprise linux +6 more +8 morePHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon...CVE-2015-4025Fix availableEPSS 17.0%7.5 High
- sqlite, apple mac os x, watchos +3 more +5 moreThe sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement...CVE-2015-3415Fix available7.5 High
- sqlite, apple mac os x, watchos +3 more +5 moreThe sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle...CVE-2015-3416Fix available7.5 High
- sqlite, apple mac os x, watchos +3 more +5 moreSQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which...CVE-2015-3414Fix available7.5 High
- pcre, mariadb, opensuse +1 more +3 moreThe pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile...CVE-2015-2326Fix available5.5 Medium
- pcre, mariadb, opensuse +1 more +3 moreThe compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile...CVE-2015-2325Fix available7.8 High
- php, apple mac os x, oracle linux +8 more +10 moreThe php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before...CVE-2015-3330Fix availableEPSS 13.5%6.8 Medium
- php, apple mac os x, opensuse +6 more +8 moreThe move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5...CVE-2015-2348Fix available5.0 Medium
- nih libzip, php, debian linux +2 more +4 moreInteger overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as...CVE-2015-2331Fix availableEPSS 27.4%7.5 High
- file project file, php, debian linux +2 morereadelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x...CVE-2014-9653Fix available7.5 High
- phpMultiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before...CVE-2015-0273Public exploitFix availableEPSS 42.8%7.5 High
- php, apple mac os x +1 moreThe build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5...CVE-2015-1352Fix available5.0 Medium
- php, apple mac os x, oracle linux +2 more +4 moreUse-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the...CVE-2015-1351Fix available7.5 High
- php** DISPUTED ** The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in...CVE-2014-9426Disputed7.5 High
- php, apple mac os x +1 moreDouble free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the...CVE-2014-94257.5 High
- php, hiphop virtual machine for php project virtual machine for php +1 moreDirectory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in...CVE-2014-9767Fix available4.3 Medium
- phpsapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x...CVE-2014-9427Fix availableEPSS 18.3%7.5 High
- phpStack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in...CVE-2014-8626Fix available7.5 High
- Show moreLoading…