PH
Language
PHP
On CISA KEVExploited in the wildRansomware-linked
748
CVEs
6
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 133High 129Medium 67Low 4
Watch
Add PHP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-9912 | 9.8 | Jan 4 | The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to… Affected: through 5.3.28; 5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; +34 more |
| CVE-2016-7568 | 9.8 | Sep 28 | Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7.0.11, allows remote attackers to cause… Affected: 5.6.0 through 5.6.26; 7.0.0 through 7.0.11 |
| CVE-2016-7417 | 9.8 | Sep 17 | ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and data type, which allows remote… Affected: through 5.6.25; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2016-7414 | 9.8 | Sep 17 | The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote… Affected: through 5.6.25; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2016-7413 | 9.8 | Sep 17 | Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service… Affected: through 5.6.25; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2016-7411 | 9.8 | Sep 17 | ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or… Affected: through 5.6.25 |
| CVE-2016-7134 | 9.8 | Sep 12 | ext/curl/interface.c in PHP 7.x before 7.0.10 does not work around a libcurl integer overflow, which allows remote attackers to cause a denial of service (allocation error and… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +4 more |
| CVE-2016-7129 | 9.8 | Sep 12 | The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (segmentation fault) or… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +5 more |
| CVE-2016-7127 | 9.8 | Sep 12 | The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate gamma values, which allows remote attackers to cause a denial… Affected: through 5.6.24; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +5 more |
| CVE-2016-7126 | 9.8 | Sep 12 | The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly validate the number of colors, which allows remote attackers to… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +5 more |
| CVE-2016-7124 | 9.8 | Sep 12 | ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +5 more |
| CVE-2016-5773 | 9.8 | Aug 7 | php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly interacts with the unserialize implementation and garbage collection,… Affected: through 5.5.36; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-5772 | 9.8 | Aug 7 | Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows remote… Affected: before 5.5.37; 5.6.0 before 5.6.23; 7.0.0 before 7.0.8 |
| CVE-2016-5771 | 9.8 | Aug 7 | spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, which allows remote… Affected: before 5.5.37; 5.6.0 before 5.6.23; 7.0.0 before 7.0.8 |
| CVE-2016-5770 | 9.8 | Aug 7 | Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a… Affected: before 5.5.37; 5.6.0 before 5.6.23; 7.0.0 before 7.0.8 |
| CVE-2016-5769 | 9.8 | Aug 7 | Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote attackers to cause a denial of service… Affected: through 5.5.36; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-5768 | 9.8 | Aug 7 | Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before… Affected: through 5.5.36; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-3132 | 9.8 | Aug 7 | Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5 |
| CVE-2016-3078 | 9.8 | Aug 7 | Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflow and application… Affected: 7.0.0 before 7.0.6 |
| CVE-2016-6296 | 9.8 | Jul 25 | Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9,… Affected: through 5.5.37; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-6295 | 9.8 | Jul 25 | ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the unserialize implementation and garbage collection, which allows… Affected: through 5.5.37; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-6294 | 9.8 | Jul 25 | The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the… Affected: through 5.5.37; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-6291 | 9.8 | Jul 25 | The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a denial of service… Affected: through 5.5.37; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-6290 | 9.8 | Jul 25 | ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly maintain a certain hash data structure, which allows remote attackers to… Affected: through 5.5.37; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-6288 | 9.8 | Jul 25 | The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other… Affected: through 5.5.37 |
| CVE-2016-4544 | 9.8 | May 22 | The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote… Affected: 5.5.0 before 5.5.35; 5.6.0 before 5.6.21; 7.0.0 before 7.0.6 |
| CVE-2016-4543 | 9.8 | May 22 | The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4542 | 9.8 | May 22 | The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4541 | 9.8 | May 22 | The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4540 | 9.8 | May 22 | The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4539 | 9.8 | May 22 | The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4538 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are… Affected: through 5.5.33; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4537 | 9.8 | May 22 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote… Affected: through 5.5.34; 5.6.0; 5.6.1; 5.6.2; 5.6.3; 5.6.4; +22 more |
| CVE-2016-4346 | 9.8 | May 22 | Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other… Affected: 7.0.0 before 7.0.4 |
| CVE-2016-4345 | 9.8 | May 22 | Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have… Affected: 7.0.0 before 7.0.4 |
| CVE-2016-4344 | 9.8 | May 22 | Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other… Affected: 7.0.0 before 7.0.4 |
| CVE-2015-8880 | 9.8 | May 22 | Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error Affected: 7.0.0 |
| CVE-2015-8876 | 9.8 | May 22 | Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a… Affected: 5.4.0 before 5.4.44; 5.5.0 before 5.5.28; 5.6.0 before 5.6.12 |
| CVE-2016-4073 | 9.8 | May 20 | Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote… Affected: 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2016-4072 | 9.8 | May 20 | The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-4071 | 9.8 | May 20 | Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2016-2554 | 9.8 | May 16 | Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application… Affected: 7.0.0; 7.0.1; 7.0.2; through 5.5.31; 5.6.0; 5.6.0; +24 more |
| CVE-2015-8835 | 9.8 | May 16 | The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not properly retrieve keys, which allows remote… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-6835 | 9.8 | May 16 | The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls, which allow remote attackers to execute… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-6834 | 9.8 | May 16 | Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to… Affected: through 5.4.44; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +34 more |
| CVE-2015-5589 | 9.8 | May 16 | The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-4643 | 9.8 | May 16 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary… Affected: before 5.4.42; 5.5.0 before 5.5.26; 5.6.0 before 5.6.10 |
| CVE-2015-4642 | 9.8 | May 16 | The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS… Affected: through 5.4.41; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +31 more |
| CVE-2015-4603 | 9.8 | May 16 | The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2015-4602 | 9.8 | May 16 | The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
The 500 most important CVEs for this product (exploited first, then by severity)