Stanislav Malyshev

11 exploits Active since May 2013
CVE-2013-3735 WRITEUP HIGH WRITEUP
PHP < 5.4.16 RC1 and 5.5.0 < RC2 - Denial of Service via Crafted Function Definition
The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted function definition, as demonstrated by an attack within a shared web-hosting environment. NOTE: the vendor's http://php.net/security-note.php page says "for critical security situations you should be using OS-level security by running multiple web servers each as their own user id.
CVSS 7.5
CVE-2015-0231 WRITEUP WRITEUP
PHP < 5.4.37 - Use-After-Free via Unserialize Duplicate Numerical Keys
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.
CVE-2016-3078 WRITEUP CRITICAL WRITEUP
PHP < 7.0.6 - Integer Overflow in ZipArchive getFromIndex and getFromName
Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted call to (1) getFromIndex or (2) getFromName in the ZipArchive class.
CVSS 9.8
CVE-2016-7131 WRITEUP HIGH WRITEUP
PHP < 5.6.25 and 7.x < 7.0.10 - Denial of Service via Malformed wddxPacket XML Document
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via a malformed wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a tag that lacks a < (less than) character.
CVSS 7.5
CVE-2016-7132 WRITEUP HIGH WRITEUP
PHP < 5.6.25 and 7.x < 7.0.10 - Denial of Service via WDDX Deserialization NULL Pointer Dereference
ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have unspecified other impact via an invalid wddxPacket XML document that is mishandled in a wddx_deserialize call, as demonstrated by a stray element inside a boolean element, leading to incorrect pop processing.
CVSS 7.5
CVE-2018-7584 WRITEUP CRITICAL WRITEUP
PHP < 5.6.33, 7.0.x < 7.0.28, 7.1.x <= 7.1.14, 7.2.x <= 7.2.2 - Stack-Based Buffer Under-Read in HTTP Response Parsing
In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string.
CVSS 9.8
CVE-2016-7480 WRITEUP CRITICAL WRITEUP
PHP < 7.0.12 - Remote Code Execution via SplObjectStorage Unserialize
The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
CVSS 9.8
CVE-2016-9934 WRITEUP HIGH WRITEUP
PHP < 5.6.28 and 7.x < 7.0.13 - Denial of Service via WDDX Packet Deserialization
ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
CVSS 7.5
CVE-2016-9935 WRITEUP CRITICAL WRITEUP
PHP < 5.6.29 and 7.x < 7.0.14 - Out-of-bounds Read in WDDX Boolean Element Parsing
The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.
CVSS 9.8
CVE-2017-5340 WRITEUP CRITICAL WRITEUP
PHP 7.0.0-7.0.14 - Remote Code Execution via Crafted Serialized Data
Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
CVSS 9.8
CVE-2018-17082 WRITEUP MEDIUM WRITEUP
PHP <5.6.38, <7.0.32, <7.1.22, <7.2.10 - XSS
The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.
CVSS 6.1