huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2016-4913: kernel: Information leak when handling NM entries containing NUL
Component: kernel
Severity: Low
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
Public date: 2016-05-05T00:00:00+00:00

A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries).  The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254. However, the value returned as the total length is the sum of *claimed* sizes, not the actual amount collected. And that's what will be passed to readdir() callback as the name length - 8Kb __copy_to_user() from a buffer allocated by __get_free_page().

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7. Future Linux kernel updates for the respective releases might address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 99d825822eade8d827a1817357cbf3f889a552d6
CVE-2016-4971: wget: Lack of filename checking allows arbitrary file upload via FTP redirect
Component: wget
Severity: Moderate
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 7 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-06-09T00:00:00+00:00

It was found that wget used a file name provided by the server for the downloaded file when following a HTTP redirect to a FTP server resource. This could cause wget to create a file with a different name than expected, possibly allowing the server to execute arbitrary code on the client.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/wget.git
Upstream fix commit: e996e322ffd42aaa051602da182d03178d0f13e1
CVE-2016-4979: httpd: X509 client certificate authentication bypass using HTTP/2
Component: httpd
Severity: Moderate
CWE: CWE-287 (Improper Authentication)
CVSS v3: 9.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2016-07-05T00:00:00+00:00

A flaw was found in the way httpd performed client authentication using X.509 client certificates. When the HTTP/2 protocol was enabled, a remote attacker could use this flaw to access resources protected by certificate authentication without providing a valid client certificate.


Affected upstream versions: n/a
Upstream repository: https://github.com/apache/httpd
Upstream fix commit: 2d0e4eff04ea963128a41faaef21f987272e05a2
CVE-2016-4989: setroubleshoot: command injection issues
Component: setroubleshoot
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
Public date: 2016-06-21T00:00:00+00:00

Shell command injection flaws were found in the way the setroubleshoot executed external commands. A local attacker able to trigger certain SELinux denials could use these flaws to execute arbitrary code with root privileges.


Affected upstream versions: n/a
Fixed upstream versions: setroubleshoot-plugins-3.0.63
Upstream repository: https://github.com/fedora-selinux/setroubleshoot
Upstream fix commit: e69378d7e82a503534d29c5939fa219341e8f2ad
CVE-2016-4992: 389-ds-base: Information disclosure via repeated use of LDAP ADD operation
Component: 389-ds-base
Severity: Low
CWE: CWE-209 (Generation of Error Message Containing Sensitive Information)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2016-06-17T00:00:00+00:00

An information disclosure flaw was found in 389 Directory Server. A user with no access to objects in certain LDAP sub-tree could send LDAP ADD operations with a specific object name. The error message returned to the user was different based on whether the target object existed or not.


Affected upstream versions: n/a
Fixed upstream versions: 389-ds-base-1.3.5.11
Upstream repository: https://github.com/389ds/389-ds-base
Upstream fix commit: 0b932d4b926d46ac5060f02617330dc444e06da1
CVE-2016-4994: gimp: Use-after-free vulnerabilities in the channel and layer properties parsing process
Component: gimp
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 2.5 (CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2016-06-20T00:00:00+00:00

Multiple use-after-free vulnerabilities were found in GIMP in the channel and layer properties parsing process when loading XCF files. An attacker could create a specially crafted XCF file which could cause GIMP to crash.


Affected upstream versions: n/a
Fixed upstream versions: GIMP_2_8_18
Upstream repository: https://git.gnome.org/browse/gimp
Upstream fix commit: e82aaa4b4ee0703c879e35ea9321fff6be3e9b6f
CVE-2016-4997: kernel: compat IPT_SO_SET_REPLACE setsockopt
Component: kernel
Severity: Important
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 7.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-06-24T00:00:00+00:00

A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitrary kernel memory when unloading a kernel module. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges.

Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux  7, MRG-2 and realtime and will be addressed in a future update.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: ce683e5f9d045e5d67d1312a42b359cb2ab2a13c
CVE-2016-4998: kernel: out of bounds reads when processing IPT_SO_SET_REPLACE setsockopt
Component: kernel
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 6.1 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2016-06-24T00:00:00+00:00

An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments.


Affected upstream versions: n/a
Fixed upstream versions: v4.6
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91
CVE-2016-4999: Dashbuilder: SQL Injection on data set lookup filters
Component: Dashbuilder
Severity: Important
CWE: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-07-14T00:00:00+00:00

A security flaw was found in the way Dashbuilder performed SQL datasets lookup requests in the Data Set Authoring UI or the Displayer editor UI. A remote attacker could use this flaw to conduct SQL injection attacks via specially-crafted string filter parameter.


Affected upstream versions: n/a
Fixed upstream versions: 0.6.0.Final
Upstream repository: https://github.com/dashbuilder/dashbuilder
Upstream fix commit: 8574899e3b6455547b534f570b2330ff772e524b
CVE-2016-5009: crash: mon_command crashes ceph monitors on receiving empty prefix
Component: crash
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.9 (CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2016-06-14T00:00:00+00:00

A flaw was found in the way handle_command() function would validate prefix value from user. An authenticated attacker could send a specially crafted prefix value resulting in ceph monitor crash.


Affected upstream versions: n/a
Fixed upstream versions: ses5-gm
Upstream repository: https://github.com/ceph/ceph
Upstream fix commit: 957ece7e95d8f8746191fd9629622d4457d690d6
CVE-2016-5011: util-linux: Extended partition loop in MBR partition table leads to DOS
Component: util-linux
Severity: Low
CVSS v3: 4.6 (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2016-07-11T00:00:00+00:00

It was found that util-linux's libblkid library did not properly handle Extended Boot Record (EBR) partitions when reading MS-DOS partition tables. An attacker with physical USB access to a protected machine could insert a storage device with a specially crafted partition table that could, for example, trigger an infinite loop in systemd-udevd, resulting in a denial of service on that machine.


Affected upstream versions: n/a
Fixed upstream versions: v2.29
Upstream repository: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git
Upstream fix commit: 7164a1c3
CVE-2016-5093: php: improper nul termination leading to out-of-bounds read in get_icu_value_internal
Component: php
Severity: Low
CWE: CWE-170 (Improper Null Termination)
Public date: 2016-05-19T00:00:00+00:00

The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a '\0' character, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted locale_get_primary_language call.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.36
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 97eff7eb57fc2320c267a949cffd622c38712484
CVE-2016-5094: php: Integer overflow in php_html_entities()
Component: php
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2016-05-01T00:00:00+00:00

Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.36
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 0da8b8b801f9276359262f1ef8274c7812d3dfda
CVE-2016-5096: php: Integer underflow causing arbitrary null write in fread/gzread
Component: php
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
Public date: 2016-04-27T00:00:00+00:00

Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer in the second argument.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.36
Upstream repository: https://github.com/php/php-src
Upstream fix commit: abd159cce48f3e34f08e4751c568e09677d5ec9c
CVE-2016-5114: php: out-of-bounds write in fpm_log.c
Component: php
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
Public date: 2015-10-21T00:00:00+00:00

An out-of-bounds write flaw was found in the fpm_log_write() logging function of PHP's FastCGI Process Manager service. A remote attacker could repeatedly send maliciously crafted requests to force FPM to exhaust file system space, creating a denial of service and preventing further logging.


Affected upstream versions: n/a
Fixed upstream versions: php-7.0.2
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 2721a0148649e07ed74468f097a28899741eb58f
CVE-2016-5118: ImageMagick: Remote code execution via filename
Component: ImageMagick
Severity: Important
CWE: CWE-20 (Improper Input Validation)
Public date: 2016-05-29T00:00:00+00:00

It was discovered that ImageMagick did not properly sanitize certain input before using it to invoke processes. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.


Affected upstream versions: n/a
Upstream repository: https://hg.code.sf.net/p/graphicsmagick/code
Upstream fix commit: ae3928faa858
CVE-2016-5126: Qemu: block: iscsi: buffer overflow in iscsi_aio_ioctl
Component: Qemu
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 5.4 (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L)
Public date: 2016-05-24T00:00:00+00:00

Quick Emulator(QEMU) built with the Block driver for iSCSI images support (virtio-blk) is vulnerable to a heap-based buffer overflow issue. The flaw could occur while processing iSCSI asynchronous I/O ioctl(2) calls. A user inside a guest could exploit this flaw to crash the QEMU process resulting in denial of service, or potentially leverage it to execute arbitrary code with QEMU-process privileges on the host.


Affected upstream versions: n/a
Fixed upstream versions: v2.7.0
Upstream repository: https://git.qemu.org/qemu.git
Upstream fix commit: a6b3167fa0e825aebb5a7cd8b437b6d41584a196
CVE-2016-5157: chromium-browser: heap overflow in pdfium
Component: chromium-browser
Severity: Important
CVSS v3: 8.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2016-08-31T00:00:00+00:00

Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to execute arbitrary code via crafted coordinate values in JPEG 2000 data.


Affected upstream versions: n/a
Fixed upstream versions: v2.2.0
Upstream repository: https://github.com/uclouvain/openjpeg
Upstream fix commit: e078172b1c3f98d2219c37076b238fb759c751ea
CVE-2016-5195: kernel: mm: privilege escalation via MAP_PRIVATE COW breakage
Component: kernel
Severity: Important
CVSS v3: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-10-19T00:00:00+00:00

A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged, local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.

Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG 2.x. This issue has been rated as having Important security impact.

Affected upstream versions: n/a
Fixed upstream versions: v4.9
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619
CVE-2016-5239: ImageMagick,GraphicsMagick: Gnuplot delegate vulnerability allowing command injection
Component: ImageMagick,GraphicsMagick
Severity: Moderate
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
Public date: 2016-05-08T00:00:00+00:00

It was discovered that ImageMagick did not properly sanitize certain input before passing it to the gnuplot delegate functionality. A remote attacker could create a specially crafted image that, when processed by an application using ImageMagick or an unsuspecting user using the ImageMagick utilities, would lead to arbitrary execution of shell commands with the privileges of the user running the application.


Affected upstream versions: n/a
Upstream repository: https://git.imagemagick.org/repos/ImageMagick
Upstream fix commit: 70a2cf326ed32bedee144b961005c63846541a16
CVE-2016-5325: nodejs: reason argument in ServerResponse#writeHead() not properly validated
Component: nodejs
Severity: Low
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2016-06-13T00:00:00+00:00

It was found that the reason argument in ServerResponse#writeHead() was not properly validated. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request.


Affected upstream versions: n/a
Fixed upstream versions: v6.7.0
Upstream repository: https://github.com/nodejs/node
Upstream fix commit: c0f13e56a20f9bde5a67d873a7f9564487160762
CVE-2016-5361: IKEv1 protocol is vulnerable to DoS amplification attack
Component: IKEv1 protocol is vulnerable to DoS amplification attack
Severity: Moderate
Public date: 2016-03-14T00:00:00+00:00

A traffic amplification flaw was found in the Internet Key Exchange version 1 (IKEv1) protocol. A remote attacker could use a libreswan server with IKEv1 enabled in a network traffic amplification denial of service attack against other hosts on the network by sending UDP packets with a spoofed source address to that server.

Statement: This is a protocol flaw which affects IKEv1. All complaint implementations are therefore affected by this flaw. Red Hat Product Security team, does not consider IKEv2 to be affected. For more details please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1308508#c2

Affected upstream versions: n/a
Fixed upstream versions: v3.17
Upstream repository: https://github.com/libreswan/libreswan
Upstream fix commit: 152d6d95632d8b9477c170f1de99bcd86d7fb1d6
CVE-2016-5384: fontconfig: Possible double free due to insufficiently validated cache files
Component: fontconfig
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-08-05T00:00:00+00:00

It was found that cache files were insufficiently validated in fontconfig. A local attacker could create a specially crafted cache file to trigger arbitrary free() calls, which in turn could lead to arbitrary code execution.


Affected upstream versions: n/a
Upstream repository: https://cgit.freedesktop.org/fontconfig
Upstream fix commit: 7a4a5bd7897d216f0794ca9dbce0a4a5c9d14940
CVE-2016-5404: ipa: Insufficient privileges check in certificate revocation
Component: ipa
Severity: Moderate
CWE: CWE-285 (Improper Authorization)
CVSS v3: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-08-17T00:00:00+00:00

An insufficient permission check issue was found in the way IPA server treats certificate revocation requests. An attacker logged in with the 'retrieve certificate' permission enabled could use this flaw to revoke certificates, possibly triggering a denial of service attack.


Affected upstream versions: n/a
Upstream repository: https://git.fedorahosted.org/cgit/freeipa.git
Upstream fix commit: cf74584d0f772f3f5eccc1d30c001e4212a104fd
CVE-2016-5412: Kernel: powerpc: kvm: Infinite loop via H_CEDE hypercall when running under hypervisor-mode
Component: Kernel
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.4 (CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2016-07-28T00:00:00+00:00

arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel through 4.7 on PowerPC platforms, when CONFIG_KVM_BOOK3S_64_HV is enabled, allows guest OS users to cause a denial of service (host OS infinite loop) by making a H_CEDE hypercall during the existence of a suspended transaction.

Statement: This issue does not affect the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the version of the kernel packages as shipped with
Red Hat Enterprise Linux 7. Future kernel updates for Red Hat Enterprise Linux 7 may address this issue.

Affected upstream versions: n/a
Fixed upstream versions: v4.8
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f024ee098476a3e620232e4a78cfac505f121245
CVE-2016-5418: libarchive: Archive Entry with type 1 (hardlink), but has a non-zero data size file overwrite
Component: libarchive
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2016-09-12T00:00:00+00:00

A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive's file system sandboxing, this issue could cause an application using libarchive to overwrite arbitrary files with arbitrary data from the archive.


Affected upstream versions: n/a
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/libarchive/libarchive
Upstream fix commit: dfd6b54ce33960e420fb206d8872fb759b577ad9
CVE-2016-5696: kernel: challenge ACK counter information disclosure.
Component: kernel
Severity: Important
CWE: CWE-203 (Observable Discrepancy)
CVSS v3: 4.8 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2016-07-12T00:00:00+00:00

It was found that the RFC 5961 challenge ACK rate limiting as implemented in the Linux kernel's networking subsystem allowed an off-path attacker to leak certain information about a given connection by creating congestion on the global challenge ACK rate limit counter and then measuring the changes by probing packets. An off-path attacker could use this flaw to either terminate TCP connection and/or inject payload into non-secured TCP connection between two endpoints on the network.

Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4 and 5.

Affected upstream versions: n/a
Fixed upstream versions: v4.7
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 75ff39ccc1bd5d3c455b6822ab09e533c551f758
CVE-2016-5699: python: http protocol steam injection attack
Component: python
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2014-11-24T00:00:00+00:00

It was found that the Python's httplib library (used by urllib, urllib2 and others) did not properly check HTTPConnection.putheader() function arguments. An attacker could use this flaw to inject additional headers in a Python application that allowed user provided header names or values.


Affected upstream versions: n/a
Upstream repository: https://hg.python.org/cpython
Upstream fix commit: 1c45047c5102
CVE-2016-5766: gd: Integer overflow in _gd2GetHeader() resulting in heap overflow
Component: gd
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-06-23T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 7722455726bec8c53458a32851d2a87982cf0eac
CVE-2016-5767: gd: Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow
Component: gd
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2016-06-23T00:00:00+00:00

An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: c395c6e5d7e8df37a21265ff76e48fe75ceb5ae6
CVE-2016-5768: php: Double free in _php_mb_regex_ereg_replace_exec
Component: php
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 3.7 (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2016-06-23T00:00:00+00:00

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash.


Affected upstream versions: n/a
Fixed upstream versions: php-5.5.37
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 5b597a2e5b28e2d5a52fc1be13f425f08f47cb62