SB2016082313 - Multiple vulnerabilities in PHP

Main Vulnerability Database SB2016082313

SB2016082313 - Multiple vulnerabilities in PHP

Published: August 23, 2016 Updated: June 12, 2025

Security Bulletin ID SB2016082313

Severity

High

Patch available

YES

Number of vulnerabilities 15

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 15 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2010-2484)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2010-3065)

The vulnerability allows a remote non-authenticated attacker to corrupt data.

The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS_UNDEF_MARKER marker, which allows context-dependent attackers to modify arbitrary session variables via a crafted session variable name.

3) Information disclosure (CVE-ID: CVE-2010-2190)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

4) Buffer overflow (CVE-ID: CVE-2010-2191)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The (1) parse_str, (2) preg_match, (3) unpack, and (4) pack functions; the (5) ZEND_FETCH_RW, (6) ZEND_CONCAT, and (7) ZEND_ASSIGN_CONCAT opcodes; and the (8) ArrayObject::uasort method in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler. NOTE: vectors 2 through 4 are related to the call time pass by reference feature.

5) Information disclosure (CVE-ID: CVE-2010-2100)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

6) Information disclosure (CVE-ID: CVE-2010-2101)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

7) Information disclosure (CVE-ID: CVE-2010-2097)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

8) Resource management error (CVE-ID: CVE-2010-1917)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (PHP crash) via a crafted first argument to the fnmatch function, as demonstrated using a long string.

9) Information disclosure (CVE-ID: CVE-2010-1860)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal call, related to the call time pass by reference feature.

10) Resource management error (CVE-ID: CVE-2010-1861)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to write to arbitrary memory addresses by using an object's __sleep function to interrupt an internal call to the shm_put_var function, which triggers access of a freed resource.

11) Information disclosure (CVE-ID: CVE-2010-1862)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

12) Information disclosure (CVE-ID: CVE-2010-1864)

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.

13) Code Injection (CVE-ID: CVE-2010-1868)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query, which triggers access of uninitialized memory.

14) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2010-1130)

The vulnerability allows a remote non-authenticated attacker to corrupt data.

session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon) characters in the argument to the session_save_path function, which allows context-dependent attackers to bypass open_basedir and safe_mode restrictions via an argument that contains multiple ; characters in conjunction with a .. (dot dot).

15) Code Injection (CVE-ID: CVE-2007-1581)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.

Remediation

Install update from vendor's website.

References