Alexandre Daubois

**Name of the Vulnerable Software and Affected Versions** php (affected versions not specified) **Description** The mysqlnd wire protocol parser reads fields from server packets without first verifying if the packet contains sufficient bytes. This allows a malicious or compromised MySQL server to send a truncated packet, causing the client to read beyond the packet buffer. This undefined behavior can lead to a process crash. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The SOAP XML parser contains a flaw where the `cleanup xml node()` function recurses once per XML nesting level without a depth limit. An unauthenticated attacker can send a SOAP request with tens of thousands of nested elements to any SoapServer endpoint, leading to stack exhaustion and a process crash. This unbounded recursion also affects the SOAP value decoder and the WSDL node search helper. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP (affected versions not specified) **Description** PHP contains an issue where credentials could be leaked during a redirect when using curl. This occurs when the application follows a redirect to an external host and inadvertently includes authentication credentials in the request to the new location. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the `listen.allowed clients` check to match based on a /96 prefix rather than the exact address. An attacker using an address that shares the first 96 bits with an authorized address can bypass the access control and reach the FastCGI endpoint. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP (affected versions not specified) **Description** OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name (CN) when no entries in the `subjectAltName` (SAN) match. According to RFC 6125, the CN should be ignored if the certificate contains any service identity. This behavior allows a certificate trusted for one name to be used to impersonate another if the CN matches the requested `peer name` despite a non-matching DNS SAN. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.