SB2018101913 - Multiple vulnerabilities in PHP 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101913

SB2018101913 - Multiple vulnerabilities in PHP

Published: October 19, 2018 Updated: June 12, 2025

Security Bulletin ID SB2018101913
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: CVE-2006-0097)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the create_named_pipe function in libmysql.c when processing a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Input validation error (CVE-ID: CVE-2005-1042)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP before 4.3.11 may allow remote attackers to execute arbitrary code via an IFD tag that leads to a negative byte count.


3) Input validation error (CVE-ID: CVE-2005-1043)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

exif.c in PHP before 4.3.11 allows remote attackers to cause a denial of service (memory consumption and crash) via an EXIF header with a large IFD nesting level, which causes significant stack recursion.


Remediation

Install update from vendor's website.

References