Multiple vulnerabilities has been discovered and corrected in php :

The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file (CVE-2014-2497).

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345 (CVE-2014-3538).

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE:
this vulnerability exists because of an incomplete fix for CVE-2012-1571 (CVE-2014-3587).

Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049 (CVE-2014-3597).

gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack \%00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3) imagegif, (4) imagejpeg, (5) imagepng, (6) imagewbmp, or (7) imagewebp function (CVE-2014-5120).

The updated php packages have been upgraded to the 5.5.16 version resolve these security flaws.

Additionally, php-apc has been rebuilt against the updated php packages and the php-timezonedb packages has been upgraded to the 2014.6 version.

According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

According to its banner, the remote web server is running a version of PHP 5.5.x prior to 5.5.16. It is, therefore, affected by the following vulnerabilities :

  - LibGD contains a NULL pointer dereference flaw in its     'gdImageCreateFromXpm' function in the 'gdxpm.c' file.
    By using a specially crafted color mapping, a remote     attacker could cause a denial of service.
    (CVE-2014-2497)

  - The original upstream patch for CVE-2013-7345 did not     provide a complete solution. It is, therefore, still     possible for a remote attacker to deploy a specially     crafted input file to cause excessive resources to be     used when trying to detect the file type using awk     regular expression rules. This can cause a denial of     service. (CVE-2014-3538)

  - An integer overflow flaw exists in the 'cdf.c' file. By     using a specially crafted CDF file, a remote attacker     could cause a denial of service. (CVE-2014-3587)

  - There are multiple buffer overflow flaws in the 'dns.c'     file related to the 'dns_get_record' and 'dn_expand'     functions. By using a specially crafted DNS record,     a remote attacker could exploit these to cause a denial     of service or execute arbitrary code. (CVE-2014-3597)

  - There exist multiple flaws in the GD component within     the 'gd_ctx.c' file where user-supplied input is not     properly validated to ensure that pathnames lack %00     sequences. By using specially crafted input, a remote     attacker could overwrite arbitrary files.
    (CVE-2014-5120)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2014-8142)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4026)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6834)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4025)

  - An integer overflow flaw was found in the way custom     objects were unserialized. Specially crafted input     processed by the unserialize() function could cause a     PHP application to crash.(CVE-2014-3669)

  - It was found that PHP move_uploaded_file() function did     not properly handle file names with a NULL character. A     remote attacker could possibly use this flaw to make a     PHP script access unexpected files and bypass intended     file system access restrictions.(CVE-2015-2348)

  - An integer overflow flaw leading to a heap-based buffer     overflow was found in the way PHP's FTP extension     parsed file listing FTP server responses. A malicious     FTP server could use this flaw to cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4022)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6836)

  - A NULL pointer dereference flaw was found in the     XSLTProcessor class in PHP. An attacker could use this     flaw to cause a PHP application to crash if it     performed Extensible Stylesheet Language (XSL)     transformations using untrusted XSLT files and allowed     the use of PHP functions to be used as XSLT functions     within XSL stylesheets.(CVE-2015-6837)

  - It was found that PHP's gd extension did not properly     handle file names with a null character. A remote     attacker could possibly use this flaw to make a PHP     application access unexpected files and bypass intended     file system access restrictions.(CVE-2014-5120)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6835)

  - Stack consumption vulnerability in     Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to cause a denial of service (segmentation     fault) via recursive method calls.(CVE-2015-8873)

  - An uninitialized pointer use flaw was found in PHP's     Exif extension. A specially crafted JPEG or TIFF file     could cause a PHP application using the     exif_read_data() function to crash or, possibly,     execute arbitrary code with the privileges of the user     running that PHP application.(CVE-2015-0232)

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-2787)

  - A buffer over-read flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2783)

  - A use-after-free flaw was found in the unserialize()     function of PHP's DateTimeZone implementation. A     malicious script author could possibly use this flaw to     disclose certain portions of server     memory.(CVE-2015-0273)

  - Multiple buffer over-read flaws were found in the     php_parserr() function of PHP. A malicious DNS server     or a man-in-the-middle attacker could possibly use this     flaw to crash a PHP application that used the     dns_get_record() function to perform a DNS     query.(CVE-2014-3597)

  - A buffer overflow flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3329)

  - Integer overflow in the ftp_genlist function in     ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before     5.5.26, and 5.6.x before 5.6.10 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-4022.(CVE-2015-4643)

  - A type confusion issue was found in PHP's phpinfo()     function. A malicious script author could possibly use     this flaw to disclose certain portions of server     memory.(CVE-2014-4721)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the remote web server is running a version of PHP 5.4.x prior to 5.4.32. It is, therefore, affected by the following vulnerabilities :

  - LibGD contains a NULL pointer dereference flaw in its     'gdImageCreateFromXpm' function in the 'gdxpm.c' file.
    By using a specially crafted color mapping, a remote     attacker could cause a denial of service.
    (CVE-2014-2497)

  - The original upstream patch for CVE-2013-7345 did not     provide a complete solution. It is, therefore, still     possible for a remote attacker to deploy a specially     crafted input file to cause excessive resources to be     used when trying to detect the file type using awk     regular expression rules. This can cause a denial of     service. (CVE-2014-3538)

  - An integer overflow flaw exists in the 'cdf.c' file. By     using a specially crafted CDF file, a remote attacker     could cause a denial of service. (CVE-2014-3587)

  - There are multiple buffer overflow flaws in the 'dns.c'     file related to the 'dns_get_record' and 'dn_expand'     functions. By using a specially crafted DNS record,     a remote attacker could exploit these to cause a denial     of service or execute arbitrary code. (CVE-2014-3597)

  - A flaw exists in the 'spl_dllist.c' file that may lead     to a use-after-free condition in the SPL component when     iterating over an object. An attacker could utilize this     to cause a denial of service. (CVE-2014-4670)

  - A flaw exists in the 'spl_array.c' file that may lead to     a use-after-free condition in the SPL component when     handling the modification of objects while sorting. An     attacker could utilize this to cause a denial of     service. (CVE-2014-4698)

  - There exist multiple flaws in the GD component within     the 'gd_ctx.c' file where user-supplied input is not     properly validated to ensure that pathnames lack %00     sequences. By using specially crafted input, a remote     attacker could overwrite arbitrary files.
    (CVE-2014-5120)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

php5 was updated to fix three security issues :

  - Insecure temporary file use for cache data was fixed by     switching to a different root only directory     /var/cache/php-pear (CVE-2014-5459)

  - An incomplete fix for CVE-2014-4049 (CVE-2014-3597) 

  - gd extension: NUL byte injection in filenames passed to     image handling functions was fixed (CVE-2014-5120)

Also a bug was fixed :

  - fixed suhosin crash if used with php     session_set_save_handler() [bnc#895658]

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

A buffer overflow flaw was found in the way the File Information (fileinfo) extension processed certain Pascal strings. A remote attacker able to make a PHP application using fileinfo convert a specially crafted Pascal string provided by an image file could cause that application to crash. (CVE-2014-3478)

Multiple flaws were found in the File Information (fileinfo) extension regular expression rules for detecting various files. A remote attacker could use either of these flaws to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2014-3538)

It was found that the fix for CVE-2012-1571 was incomplete; the File Information (fileinfo) extension did not correctly parse certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-3587)

It was found that PHP's gd extension did not properly handle file names with a null character. A remote attacker could possibly use this flaw to make a PHP application access unexpected files and bypass intended file system access restrictions. (CVE-2014-5120)

A NULL pointer dereference flaw was found in the gdImageCreateFromXpm() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application using gd via a specially crafted X PixMap (XPM) file. (CVE-2014-2497)

Multiple buffer over-read flaws were found in the php_parserr() function of PHP. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-3597)

Two use-after-free flaws were found in the way PHP handled certain Standard PHP Library (SPL) Iterators and ArrayIterators. A malicious script author could possibly use either of these flaws to disclose certain portions of server memory. (CVE-2014-4670, CVE-2014-4698)

The CVE-2014-3478 issue was discovered by Francisco Alonso of Red Hat Product Security, the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team, and the CVE-2014-3597 issue was discovered by David Kutalek of the Red Hat BaseOS QE.

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1327 advisory.

    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1327 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. PHP's fileinfo module provides functions used to identify a     particular file according to the type of data contained by the file.

    A buffer overflow flaw was found in the way the File Information (fileinfo)     extension processed certain Pascal strings. A remote attacker able to make     a PHP application using fileinfo convert a specially crafted Pascal string     provided by an image file could cause that application to crash.
    (CVE-2014-3478)

    Multiple flaws were found in the File Information (fileinfo) extension     regular expression rules for detecting various files. A remote attacker     could use either of these flaws to cause a PHP application using fileinfo     to consume an excessive amount of CPU. (CVE-2014-3538)

    It was found that the fix for CVE-2012-1571 was incomplete; the File     Information (fileinfo) extension did not correctly parse certain Composite     Document Format (CDF) files. A remote attacker could use this flaw to crash     a PHP application using fileinfo via a specially crafted CDF file.
    (CVE-2014-3587)

    It was found that PHP's gd extension did not properly handle file names     with a null character. A remote attacker could possibly use this flaw to     make a PHP application access unexpected files and bypass intended file     system access restrictions. (CVE-2014-5120)

    A NULL pointer dereference flaw was found in the gdImageCreateFromXpm()     function of PHP's gd extension. A remote attacker could use this flaw to     crash a PHP application using gd via a specially crafted X PixMap (XPM)     file. (CVE-2014-2497)

    Multiple buffer over-read flaws were found in the php_parserr() function of     PHP. A malicious DNS server or a man-in-the-middle attacker could possibly     use this flaw to execute arbitrary code as the PHP interpreter if a PHP     application used the dns_get_record() function to perform a DNS query.
    (CVE-2014-3597)

    Two use-after-free flaws were found in the way PHP handled certain Standard     PHP Library (SPL) Iterators and ArrayIterators. A malicious script author     could possibly use either of these flaws to disclose certain portions of     server memory. (CVE-2014-4670, CVE-2014-4698)

    The CVE-2014-3478 issue was discovered by Francisco Alonso of Red Hat     Product Security, the CVE-2014-3538 issue was discovered by Jan Kalua of     the Red Hat Web Stack Team, and the CVE-2014-3597 issue was discovered by     David Kutlek of the Red Hat BaseOS QE.

    All php users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, the httpd daemon must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

21 Aug 2014, PHP 5.5.16

Core :

  - Fixed bug #67693 (incorrect push to the empty array)     (Tjerk)

    - Fixed bug #67717 (segfault in dns_get_record).
      (CVE-2014-3597) (Remi)

COM :

  - Fixed missing type checks in com_event_sink (Yussuf     Khalil, Stas).

Fileinfo :

  - Fixed bug #67705 (extensive backtracking in rule regular     expression). (CVE-2014-3538) (Remi)

    - Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587)       (Remi)

FPM :

  - Fixed bug #67635 (php links to systemd libraries without     using pkg-config). (pacho at gentoo.org, Remi)

GD :

  - Fixed bug #66901 (php-gd 'c_color' NULL pointer     dereference). (CVE-2014-2497) (Remi)

    - Fixed bug #67730 (Null byte injection possible with       imagexxx functions). (CVE-2014-5120) (Ryan Mauger)

Milter :

  - Fixed bug #67715 (php-milter does not build and crashes     randomly). (Mike) OpenSSL :

  - Fixed missing type checks in OpenSSL options (Yussuf     Khalil, Stas).

readline :

  - Fixed bug #55496 (Interactive mode doesn't force a     newline before the prompt). (Bob, Johannes)

    - Fixed bug #67496 (Save command history when exiting       interactive shell with control-c). (Dmitry Saprykin,       Johannes)

Sessions :

  - Fixed missing type checks in php_session_create_id     (Yussuf Khalil, Stas).

ODBC :

  - Fixed bug #60616 (odbc_fetch_into returns junk data at     end of multi-byte char fields). (Keyur)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
77651	Mandriva Linux Security Advisory : php (MDVSA-2014:172)	Nessus	Mandriva Local Security Checks	2014/9/12	2021/1/6	medium
78556	PHP 5.6.0 Multiple Vulnerabilities	Nessus	CGI abuses	2014/10/17	2025/5/26	high
77403	PHP 5.5.x < 5.5.16 Multiple Vulnerabilities	Nessus	CGI abuses	2014/8/27	2025/5/26	medium
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/8/30	2021/1/6	high
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical
124996	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
77402	PHP 5.4.x < 5.4.32 Multiple Vulnerabilities	Nessus	CGI abuses	2014/8/27	2025/5/26	medium
77543	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : php (SSA:2014-247-01)	Nessus	Slackware Local Security Checks	2014/9/5	2021/1/14	medium
77720	openSUSE Security Update : php5 (openSUSE-SU-2014:1133-1)	Nessus	SuSE Local Security Checks	2014/9/17	2021/1/19	medium
77996	CentOS 7 : php (CESA-2014:1327)	Nessus	CentOS Local Security Checks	2014/10/1	2021/1/4	medium
78005	Oracle Linux 7 : php (ELSA-2014-1327)	Nessus	Oracle Linux Local Security Checks	2014/10/1	2025/4/29	medium
78009	RHEL 7 : php (RHSA-2014:1327)	Nessus	Red Hat Local Security Checks	2014/10/1	2025/4/15	medium
77481	Fedora 19 : php-5.5.16-1.fc19 (2014-9679)	Nessus	Fedora Local Security Checks	2014/9/3	2021/1/11	medium

検出

プラグインの検索

medium

high

medium

high

critical

critical

medium

medium

medium

medium

medium

medium

medium