Vulnerabilities > Opensuse

DATE CVE VULNERABILITY TITLE RISK
2016-05-22 CVE-2016-4544 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate TIFF start data, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
php opensuse fedoraproject debian CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4543 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
hp php fedoraproject opensuse CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4542 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not properly construct spprintf arguments, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.
network
low complexity
php opensuse fedoraproject CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4541 The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
network
low complexity
fedoraproject php opensuse
critical
 9.8
9.8
2016-05-22 CVE-2016-4540 The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset.
network
low complexity
fedoraproject opensuse php
critical
 9.8
9.8
2016-05-22 CVE-2016-4539 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products
The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero.
network
low complexity
php opensuse fedoraproject CWE-119
critical
 9.8
9.8
2016-05-22 CVE-2016-4538 Improper Input Validation vulnerability in multiple products
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variable, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
network
low complexity
php fedoraproject opensuse CWE-20
critical
 9.8
9.8
2016-05-22 CVE-2016-4537 Improper Input Validation vulnerability in multiple products
The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call.
network
low complexity
php opensuse fedoraproject CWE-20
critical
 9.8
9.8
2016-05-22 CVE-2016-4346 Integer Overflow or Wraparound vulnerability in multiple products
Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a long string, leading to a heap-based buffer overflow.
network
low complexity
php opensuse CWE-190
critical
 9.8
9.8
2016-05-22 CVE-2016-4343 Access of Uninitialized Pointer vulnerability in multiple products
The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive.
network
low complexity
php opensuse CWE-824
8.8
8.8