oss-security - CVE Request: PHP v7 - Code execution vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOdP2ADNoNVvdXfGDbAPyqscpjDe=OGQQM-AO9fsr0pBUF8eAw@mail.gmail.com>
Date: Thu, 30 Jul 2015 13:16:38 +0200
From: Fourny Dimitri <fourny.d@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: PHP v7 - Code execution vulnerability

Hello,

An arbitrary code execution is possible in the function str_ireplace()
with PHP 7.
The vulnerability is in the function php_string_tolower().

Patch: http://git.php.net/?p=php-src.git;a=commit;h=6aeee47b2cd47915ccfa3b41433a3f57aea24dd5

Report: https://bugs.php.net/bug.php?id=70140

Could you please assign a CVE for this vulnerability? Thank you.

Regards, Dimitri Fourny.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.