debian/php-pecl-http vulnerabilities

Latest debian/php-pecl-http CVEs

Newest publication first

1. DLA-1929-1 php-pecl-http - security update

   Published 2019-09-20

   Unknown

2. CVE-2016-7398 A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers...

   Published 2019-09-06

   Critical·CVSS 9.8 EPSS 6.8%

   A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.

3. CVE-2016-5873 Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.

   Published 2017-01-23

   Critical·CVSS 9.8 EPSS 4.7%

   Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-printable characters in a URL.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.