Whitehat002

**Nome do software vulnerável e versões afetadas** Kernel do Linux (versões afetadas não especificadas) **Descrição** O problema está relacionado a um potencial uso após liberação (use-after-free) na função moxart remove(), em que a estrutura mmc host poderia ser acessada após ter sido liberada. Isso poderia permitir que um invasor comprometesse a confidencialidade, a integridade e a disponibilidade de informações protegidas. A correção envolve salvar o registro base do dispositivo e usá-lo em vez da desreferência do ponteiro. **Recomendações** No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** PHP versions 7.x through 7.1.5 **Description** The issue is caused by an integer overflow in the `mysqli real escape string` function, which can be exploited by remote attackers to cause a denial of service, resulting in a buffer overflow and application crash, or possibly have other unspecified impacts via a long string. **Recommendations** For PHP versions 7.x through 7.1.5, consider updating to a version that fixes the integer overflow in the `mysqli real escape string` function to prevent potential exploitation. As a temporary workaround, consider restricting the input length to prevent long strings from being processed by the `mysqli real escape string` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** PHP version 7.1.5 Netapp storage automation store (affected versions not specified) **Description** The issue is related to an out of bounds access in the php pcre replace impl function via a crafted preg replace call. There is also a mention of a vulnerability in netapp storage automation store, although the details are not specified. **Recommendations** For PHP version 7.1.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Netapp storage automation store, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP version 7.1.5 **Description** The issue is related to the i zval ptr dtor function in Zend/zend variables.h, which allows attackers to cause a denial of service (memory consumption and application crash) or possibly have unspecified other impact by triggering crafted operations on array data structures. This can lead to memory consumption and application crash when specially crafted commands are executed on array data structures. **Recommendations** For PHP version 7.1.5, consider updating to a newer version to mitigate the risk, as the current version allows for denial of service and potential other impacts due to the i zval ptr dtor function issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PHP versions through 7.1.4 **Description** The issue allows attackers to cause a denial of service via operations on long strings, resulting in memory consumption and application crash. The vendor disputes this, stating that GMP safely aborts in case of an OOM condition, and the only attack vector is denial of service. However, if attacker-controlled, unbounded allocations are allowed, there is a DoS vector regardless of GMP's OOM behavior. **Recommendations** For PHP versions through 7.1.4, consider restricting the length of input strings to prevent unbounded allocations and minimize the risk of denial of service attacks. As a temporary workaround, monitor application memory consumption and implement measures to prevent excessive memory usage. At the moment, there is no information about a newer version that contains a fix for this vulnerability.