PHP Security Center

Information Disclosure

out-of-bounds read when using a malformed url-encoded string

Information Disclosure

information disclosure in exif_read_data() function

Remote Code Execution

by using mb_strtolower() function with UTF-32LE encoding leads to potential code execution

Remote File Inclusion

information disclosure in function get_headers

Denial of Service

NULL pointer dereference in PHP session upload progress

Information Disclosure

heap-based buffer overflow in phar_extract_file

Information Disclosure

Out of bounds read in php_strip_tags_ex

Information Disclosure

Global buffer-overflow in mbfl_filt_conv_big5_wchar function

Privilege Escalation

files added to tar with Phar::buildFromIterator have all-access permissions

Privilege Escalation

PHP DirectoryIterator class accepts filenames with embedded null byte and treats them as terminating at that byte