Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 7 Sep 2015 14:51:24 +0200
From: Marcus Meissner <>
To: OSS Security List <>,,
Subject: CVE Request: PHP remote exploits (even more)


the last patch of PHP remote exploits have no CVEs assigned yet, but here are even more.

Please assign CVEs.	Use After Free Vulnerability in unserialize() 
		Given attacker input to unserialize() we should consider this a security issue.	Use after free vulnerability in session deserializer
		Same.	SOAP serialize_function_call() type confusion / RCE
		Definitely, even the summary has enough indication for me.	yet another use-after-free vulnerability in unserialize() with SplObjectStorage
		I would also say this can be attacker driven, so needs a CVE.	yet another use-after-free vulnerability in unserialize() with SplDoublyLinkedL
		Same.	NULL pointer dereference
		Denial of service, these queries might be fed from remote.

Perhaps CVEs also for:	Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes

	Questionable. It seems no crash was observed, so no denial of service. At most a information leak. 	HAVAL gives wrong hashes in specific cases

	Questionable. I am not sure this is attacker driveable or if an attacker could do anything with this.

	Various PCRE issues caused by the regexp string. There has been a tendency to either declare this CVE worthy or
	declare that its not attacker driven usually.

Ciao, Marcus

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.