Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.

apache2-mod_php7-7.0.14-1.4 on GA media

php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024) php: zend_strndup() NULL pointer dereference may cause DoS php: XSLT file writing vulnerability php: tidy_diagnose() NULL pointer dereference may cause DoS php: strtotime timezone memory leak php: $_FILES array indexes corruption crypt(): DES encrypted password weakness php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h php: Integer overflow leading to heap-buffer overflow in the Phar extension