| Description: | Summary:
PHP is prone to multiple vulnerabilities.
Vulnerability Insight:
The following flaws exist:
- Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to use-after-free).
(CVE-2016-10166)
- Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (CVE-2019-6977)
- Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (CVE-2019-9023)
- Fixed bug #77371 (heap buffer overflow in mb regex functions - compile_string_node).
(CVE-2019-9023)
- Fixed bug #77381 (heap buffer overflow in multibyte match_at). (CVE-2019-9023)
- Fixed bug #77382 (heap buffer overflow due to incorrect length in expand_case_fold_string).
(CVE-2019-9023)
- Fixed bug #77385 (buffer overflow in fetch_token). (CVE-2019-9023)
- Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (CVE-2019-9023)
- Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (CVE-2019-9023)
- Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (CVE-2019-9021)
- Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
- Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
Affected Software/OS:
PHP versions before 5.6.40, 7.x before 7.1.26, 7.2.x before
7.2.14 and 7.3.x before 7.3.1.
Solution:
Update to version 5.6.40, 7.1.16, 7.2.14, 7.3.1 or later.
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
