RHSA-2016:2750 Red Hat Security Advisory: rh-php56 security, bug fix, and enhancement update
gd: incorrect boundary adjustment in _gdContributionsCalc php: ZipArchive:: extractTo allows for directory traversal when creating directories pcre: heap buffer overflow in compile_branch() pcre: heap buffer over-read in pcre_compile2() (8.37/23) pcre: infinite recursion compiling pattern with zero-repeated groups that include recursive back reference (8.36/19) pcre: infinite recursion compiling pattern with recursive reference in a group with indefinite repeat (8.36/20) pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4) pcre: stack overflow caused by mishandled group empty match (8.38/11) pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18) pcre: Buffer overflow caused by duplicate named references (8.38/36) pcre: Buffer overflow caused by repeated conditional group (8.38/3) pcre: buffer overflow caused by recursive back reference by name within certain group (8.38/4) pcre: buffer overflow caused by named forward reference to duplicate group number (8.38/30) pcre: Buffer overflow caused by lookbehind assertion (8.38/6) pcre: buffer overflow for forward reference within backward assertion with excess closing parenthesis (8.38/18) pcre: inefficient posix character class syntax check (8.38/16) pcre: buffer overflow caused by patterns with duplicated named groups with (?| (8.38/27) pcre: Buffer overflow caused by duplicate named references (8.38/36) php: type confusion issue in Soap Client call() method file: Buffer over-write in finfo_open with malformed magic file php: libxml_disable_entity_loader setting is shared between threads php: openssl_random_pseudo_bytes() is not cryptographically secure php: Stack consumption vulnerability in Zend/zend_exceptions.c gd: gdImageFillToBorder deep recursion leading to stack overflow php: Zend/zend_exceptions.c does not validate certain Exception objects gd: gdImageScaleTwoPass function in gd_interpolation.c uses inconsistent allocate and free approaches php: odbc_bindcols function mishandles driver behavior for SQL_WVARCHAR columns php: HTTP response splitting in header() function php: Out-of-bounds memory read via gdImageRotateInterpolated php: buffer overflow in handling of long link names in tar phar archives php: Signedness vulnerability causing heap overflow in libgd php: Use after free in WDDX Deserialize when processing XML data php: Out-of-bounds read in phar_parse_zipfile() php: Integer overflow in php_raw_url_encode php: Format string vulnerability in php_snmp_error() php: Invalid memory write in phar on filename containing \0 inside name php: mb_strcut() Negative size parameter in memcpy php: use of uninitialized pointer in PharFileInfo::getContent php: Uninitialized pointer in phar_make_dirstream() php: Invalid free() instead of efree() in phar_extract_file() php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition php: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition php: xml_parse_into_struct() can crash when XML parser is re-used php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used php: OOB read in grapheme_stripos and grapheme_strpos when negative offset is used php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input php: Out-of-bounds heap memory read in exif_read_data() caused by malformed input php: improper nul termination leading to out-of-bounds read in get_icu_value_internal php: Integer overflow in php_html_entities() php: Integer underflow causing arbitrary null write in fread/gzread php: out-of-bounds write in fpm_log.c php: Improper error handling in bzread() gd: Integer overflow in _gd2GetHeader() resulting in heap overflow gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow php: Double free in _php_mb_regex_ereg_replace_exec php: Int/size_t confusion in SplFileObject::fread php: Use After Free Vulnerability in PHP's GC algorithm and unserialize php: Double Free Corruption in wddx_deserialize php: ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize gd: Invalid color index not properly handled php,gd: Integer overflow error within _gdContributionsAlloc() php: Buffer over-read in php_url_parse_ex php: Integer overflow leads to buffer overflow in virtual_file_ex php: Use after free in unserialize() with Unexpected Session Deserialization php: Out-of-bounds access in exif_process_IFD_in_MAKERNOTE php: Null pointer dereference in exif_process_user_comment php: Out-of-bounds access in locale_accept_from_http php: Use after free in SNMP with GC and unserialize() php: Heap buffer overflow vulnerability in simplestring_addn in simplestring.c php: Stack-based buffer overflow vulnerability in php_stream_zip_opener php: bypass __wakeup() in deserialization of an unexpected object php: Session Data Injection Vulnerability php: select_colors write out-of-bounds php: imagegammacorrect allows arbitrary write access php: Memory Leakage In exif_process_IFD_in_TIFF php: wddx_deserialize allows illegal memory access php: wddx_deserialize null dereference php: wddx_deserialize null dereference with invalid xml php: wddx_deserialize null dereference in php_wddx_pop_element
CVSS v3.0 score: 7.5