Vulnerabilities > PHP > PHP > 5.1.4

DATE CVE VULNERABILITY TITLE RISK
2007-02-13 CVE-2007-0905 Multiple vulnerability in PHP 5.2.0 and Prior Versions
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension.
network
low complexity
php trustix
7.5
7.5
2006-11-04 CVE-2006-5706 Local Security vulnerability in PHP
Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions.
local
low complexity
php
7.2
7.2
2006-11-04 CVE-2006-5465 Buffer Overflow vulnerability in PHP HTMLEntities HTMLSpecialChars
Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.
network
low complexity
php
7.5
7.5
2006-10-10 CVE-2006-5178 Race Condition vulnerability in PHP
Race condition in the symlink function in PHP 5.1.6 and earlier allows local users to bypass the open_basedir restriction by using a combination of symlink, mkdir, and unlink functions to change the file path after the open_basedir check and before the file is opened by the underlying system, as demonstrated by symlinking a symlink into a subdirectory, to point to a parent directory via ..
local
high complexity
php CWE-362
6.2
6.2
2006-10-10 CVE-2006-4812 Code Injection vulnerability in PHP
Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).
network
low complexity
php CWE-94
critical
 10.0
10
2006-09-12 CVE-2006-4625 Unspecified vulnerability in PHP
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
local
low complexity
php
3.6
3.6
2006-08-31 CVE-2006-4486 Numeric Errors vulnerability in PHP
Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.
network
high complexity
php CWE-189
2.6
2.6
2006-08-31 CVE-2006-4485 Input Validation vulnerability in PHP
The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read.
network
low complexity
php
critical
 10.0
10
2006-08-31 CVE-2006-4484 Input Validation vulnerability in PHP
Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the table array.
network
high complexity
php
2.6
2.6
2006-08-31 CVE-2006-4483 Missing Authorization vulnerability in PHP
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.
network
php CWE-862
critical
 9.3
9.3