# CVEs published 2016-01-19

11 CVEs were published on January 19, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5590](https://cve.now/CVE-2015-5590.md): Stack-based buffer overflow in the phar\_fix\_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before (no CVSS)
- [CVE-2015-6527](https://cve.now/CVE-2015-6527.md): The php\_str\_replace\_in\_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code v (no CVSS)
- [CVE-2015-6831](https://cve.now/CVE-2015-6831.md): Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to (no CVSS)
- [CVE-2015-6832](https://cve.now/CVE-2015-6832.md): Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl\_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6 (no CVSS)
- [CVE-2015-6833](https://cve.now/CVE-2015-6833.md): Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote att (no CVSS)
- [CVE-2015-6836](https://cve.now/CVE-2015-6836.md): The SoapClient \_\_call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage (no CVSS)
- [CVE-2015-8616](https://cve.now/CVE-2015-8616.md): Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator\_sort.c in PHP 7.x before 7.0.1 allows (no CVSS)
- [CVE-2015-8617](https://cve.now/CVE-2015-8617.md): Format string vulnerability in the zend\_throw\_or\_error function in Zend/zend\_execute\_API.c in PHP 7.x before 7.0.1 allows remote attackers t (no CVSS)
- [CVE-2016-1903](https://cve.now/CVE-2016-1903.md): The gdImageRotateInterpolated function in ext/gd/libgd/gd\_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 al (no CVSS)
- [CVE-2016-1904](https://cve.now/CVE-2016-1904.md): Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly ha (no CVSS)
- [CVE-2016-1907](https://cve.now/CVE-2016-1907.md): The ssh\_packet\_read\_poll2 function in packet.c in OpenSSH before 7.1p2 allows remote attackers to cause a denial of service (out-of-bounds r (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.