# CVEs published 2016-05-16 27 CVEs were published on May 16, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2014-0236](https://cve.now/CVE-2014-0236.md): file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer (no CVSS) - [CVE-2015-3152](https://cve.now/CVE-2015-3152.md): Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mea (no CVSS) - [CVE-2015-3411](https://cve.now/CVE-2015-3411.md): PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote a (no CVSS) - [CVE-2015-3412](https://cve.now/CVE-2015-3412.md): PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote a (no CVSS) - [CVE-2015-4116](https://cve.now/CVE-2015-4116.md): Use-after-free vulnerability in the spl\_ptr\_heap\_insert function in ext/spl/spl\_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows r (no CVSS) - [CVE-2015-4598](https://cve.now/CVE-2015-4598.md): PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote (no CVSS) - [CVE-2015-4599](https://cve.now/CVE-2015-4599.md): The SoapFault::\_\_toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacker (no CVSS) - [CVE-2015-4600](https://cve.now/CVE-2015-4600.md): The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of (no CVSS) - [CVE-2015-4601](https://cve.now/CVE-2015-4601.md): PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an une (no CVSS) - [CVE-2015-4602](https://cve.now/CVE-2015-4602.md): The \_\_PHP\_Incomplete\_Class function in ext/standard/incomplete\_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 all (no CVSS) - [CVE-2015-4603](https://cve.now/CVE-2015-4603.md): The exception::getTraceAsString function in Zend/zend\_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows (no CVSS) - [CVE-2015-4604](https://cve.now/CVE-2015-4604.md): The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before (no CVSS) - [CVE-2015-4605](https://cve.now/CVE-2015-4605.md): The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before (no CVSS) - [CVE-2015-4642](https://cve.now/CVE-2015-4642.md): The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remo (no CVSS) - [CVE-2015-4643](https://cve.now/CVE-2015-4643.md): Integer overflow in the ftp\_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remo (no CVSS) - [CVE-2015-4644](https://cve.now/CVE-2015-4644.md): The php\_pgsql\_meta\_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x bef (no CVSS) - [CVE-2015-5589](https://cve.now/CVE-2015-5589.md): The phar\_convert\_to\_other function in ext/phar/phar\_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not val (no CVSS) - [CVE-2015-6834](https://cve.now/CVE-2015-6834.md): Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute (no CVSS) - [CVE-2015-6835](https://cve.now/CVE-2015-6835.md): The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php\_var\_unserialize calls, w (no CVSS) - [CVE-2015-6837](https://cve.now/CVE-2015-6837.md): The xsl\_ext\_function\_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml (no CVSS) - [CVE-2015-6838](https://cve.now/CVE-2015-6838.md): The xsl\_ext\_function\_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml (no CVSS) - [CVE-2015-8835](https://cve.now/CVE-2015-8835.md): The make\_http\_soap\_request function in ext/soap/php\_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not prope (no CVSS) - [CVE-2015-8838](https://cve.now/CVE-2015-8838.md): ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is option (no CVSS) - [CVE-2015-8873](https://cve.now/CVE-2015-8873.md): Stack consumption vulnerability in Zend/zend\_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote a (no CVSS) - [CVE-2015-8874](https://cve.now/CVE-2015-8874.md): Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltobor (no CVSS) - [CVE-2016-2554](https://cve.now/CVE-2016-2554.md): Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cau (no CVSS) - [CVE-2016-3185](https://cve.now/CVE-2016-3185.md): The make\_http\_soap\_request function in ext/soap/php\_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-05-16 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.