PHP Multiple Vulnerabilities

Multiple vulnerabilities were identified in PHP. A remote user can bypass security controls, cause denial of service conditions, and execute arbitrary code on the target system.

1. The set_include_path(), tempnam(), rmdir(), and readlink() functions accept a null value ('/0') in a path. A remote user may be able to supply a specially crafted value to bypass security controls based on path values.
2. A remote user can send a specially crafted request to trigger a flaw in the parsing of multipart HTTP POST requests to consume excessive CPU resources on the target system.
3. A remote user can create a specially crafted Phar archive that, when processed by the target application, will trigger an integer underflow in phar_parse_tarfile() and cause the application to potentially execute arbitrary code.