March 2007 is over and so is the Month of PHP Bugs project initiated by Stefan Esser. The number of PHP flaws revealed during one month it’s astonishing : 44. Many of these bugs pose a real threat to PHP installs older than 4.4.5 or 5.2.1 . so it’s no wonder that the whole project stirred a lot of controversy and debate. Here are bugs 29 to 44 :

29. PHP 5.2.1 unserialize() Information Leak Vulnerability The new S: datatype in unserialize() does not work at all which leads to disclosure of heap memory content.
30. PHP _SESSION unset() Vulnerability Unsetting HTTP_SESSION_VARS and _SESSION can lead to arbitrary code execution.
31. PHP _SESSION Deserialization Overwrite Vulnerability Deserialization of session data can overwrite _SESSION which can be exploited to execute arbitrary code.
32. PHP 4.4.5/4.4.6 session_decode() Double Free Vulnerability The security fix for MOPB-31-2007 introduced a double free vulnerability into PHP 4 that can lead to the execution of arbitrary code.
33. PHP mail() Message ASCIIZ Byte Truncation ASCIIZ character injection into an email message will truncate it.
34. PHP mail() Header Injection Through Subject and To Parameters A flaw in handling folded Subject and To headers allows mail header injection through both fields.
35. PHP 4 zip_entry_read() Integer Overflow Vulnerability The zip_entry_read() function of PHP 4 is vulnerable to an integer overflow in memory allocation that leads to an exploitable bufferoverflow.
36. PHP session.save_path open_basedir Bypass Vulnerability Due to some magic directory guessing a script can bypass the open_basedir restriction on the session save path.
37. PHP iptcembed() Interruption Information Leak Vulnerability A malicious user space error handler that interrupts iptcembed() can manipulate its parameters which leads to disclosure of arbitrary heap memory.
38. PHP printf() Family 64 Bit Casting Vulnerabilities A 64 bit long to int cast results in multiple flaws in PHP’s printf() function family that lead to a new class of exploitable vulnerabilities. PHP Application Format String Vulnerabilites.
39. PHP str_replace() Memory Allocation Integer Overflow Vulnerability When a single char is replaced by a long string many times in str_replace() this can result in an integer overflow in memory allocation that leads to a buffer overflow vulnerability.
40. PHP imap_mail_compose() Boundary Stack Buffer Overflow Vulnerability An overlong boundary string passed to imap_mail_compose() will overflow a stack buffer and lead to arbitrary code execution.
41. PHP 5 sqlite_udf_decode_binary() Buffer Overflow Vulnerability Calling sqlite_udf_decode_binary() with a malformed input string can lead to an exploitable buffer overflow
42. PHP 5 php_stream_filter_create() Off By One Vulnerablity The internal wildcard handling for stream filters contains an exploitable off by one overflow vulnerability that can be triggered by accessing a php://filter URL.
43. PHP msg_receive() Memory Allocation Integer Overflow Vulnerabilty An unchecked maxsize parameter to the msg_receive() function can result in an integer overflow during memory allocation that results in an exploitable buffer overflow.
44. PHP 5.2.0 Memory Manager Signed Comparision Vulnerability Due to a signed integer comparison the request for more than 2 GB of memory will be answered with a minimum size memory block. This results in a myriad of (sometimes remotely) exploitable buffer overflows.