此 php53 更新可修正下列問題：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2015-7803：解壓縮 tar phar 封存時存有一個堆疊溢位弱點，其可能導致程式碼執行。[bsc#949961] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此 php5 更新可修正下列安全性問題：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

此更新是從 SUSE:SLE-12:Update 更新專案匯入。

此 php53 更新可修正下列問題：

- CVE-2016-5093：一個 get_icu_value_internal 超出邊界讀取可能會損毀 php 解譯器 (bsc#982010)

- CVE-2016-5094、CVE-2016-5095：不允許建立長度超出 int 範圍的字串，以避免溢位 (bsc#982011、bsc#982012)

- CVE-2016-5096：fread 中的一個 int/size_t 混淆可造成損毀的記憶體 (bsc#982013)

- CVE-2016-5114：fpm_log.c 記憶體洩漏和緩衝區溢位可能會導致資訊洩漏至 php 處理程序之外，或覆寫緩衝區 1 個位元組 (bsc#982162)

- CVE-2016-4346：ext/standard/string.c 中的一個堆積溢位 (bsc#977994)

- CVE-2016-4342：修正了 tar/zip/phar 剖析器中的一個堆積損毀 (bsc#977991)

- CVE-2016-4537、CVE-2016-4538：bcpowmod 接受負比例而造成堆積緩衝區溢位，進而損毀 _one_ definition (bsc#978827)

- CVE-2016-4539：格式錯誤的輸入造成 xml_parse_into_struct() 函式中發生分割錯誤問題 (bsc#978828)

- CVE-2016-4540、CVE-2016-4541：指定負位移時 zif_grapheme_stripos 中發生超出邊界記憶體讀取問題 (bsc#978829)

- CVE-2016-4542、CVE-2016-4543、CVE-2016-4544：
格式錯誤的輸入造成 exif_read_data() 中發生超出邊界堆積記憶體讀取問題 (bsc#978830)

- CVE-2015-4116：spl_ptr_heap_insert 函式中有釋放後使用弱點 (bsc#980366)

- CVE-2015-8873：Zend/zend_exceptions.c 中有堆疊消耗弱點 (bsc#980373)

- CVE-2015-8874：GD 中有堆疊消耗弱點 (bsc#980375)

- CVE-2015-8879：ext/odbc/php_odbc.c 中的 dbc_bindcols 函式不當處理 SQL_WVARCHAR 的驅動程式行為 (bsc#981050)

之前也已在 SUSE Linux Enterprise 11 SP4 上修正，但尚未隨附於 SUSE Linux Enterprise Server 11 SP3 LTSS：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284]

- CVE-2015-7803：解壓縮 tar phar 封存時存有一個堆疊溢位弱點，其可能導致程式碼執行。[bsc#949961]

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912]

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

- CVE-2016-4073：由於錯誤處理 mb_strcut() 中的字串長度計算，遠端攻擊者可藉此造成拒絕服務，或可能執行任意程式碼 (bsc#977003)

- CVE-2015-8867：PHP 函式 openssl_random_pseudo_bytes() 未傳回以密碼編譯方式保護安全的隨機位元組 (bsc#977005)

- CVE-2016-4070：libxml_disable_entity_loader() 設定會在執行緒之間分享，其可導致 XML 外部實體插入和實體擴充問題 (bsc#976997)

- CVE-2015-8866：由於錯誤處理 php_raw_url_encode() 中的大型字串，遠端攻擊者可藉此造成拒絕服務 (bsc#976996)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.45. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for php53 fixes the following issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961] Note: we do not ship the     phar extension currently, so we are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

This update was imported from the SUSE:SLE-12:Update update project.

This update for php53 fixes the following issues :

  - CVE-2016-5093: A get_icu_value_internal out-of-bounds     read could crash the php interpreter (bsc#982010)

  - CVE-2016-5094,CVE-2016-5095: Don't allow creating     strings with lengths outside int range, avoids overflows     (bsc#982011,bsc#982012)

  - CVE-2016-5096: A int/size_t confusion in fread could     corrupt memory (bsc#982013)

  - CVE-2016-5114: A fpm_log.c memory leak and buffer     overflow could leak information out of the php process     or overwrite a buffer by 1 byte (bsc#982162)

  - CVE-2016-4346: A heap overflow was fixed in     ext/standard/string.c (bsc#977994)

  - CVE-2016-4342: A heap corruption was fixed in     tar/zip/phar parser (bsc#977991)

  - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative     scale causing heap buffer overflow corrupting _one_     definition (bsc#978827)

  - CVE-2016-4539: Malformed input causes segmentation fault     in xml_parse_into_struct() function (bsc#978828)

  - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read     in zif_grapheme_stripos when given negative offset     (bsc#978829)

  - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544:
    Out-of-bounds heap memory read in exif_read_data()     caused by malformed input (bsc#978830)

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function (bsc#980366)

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c (bsc#980373)

  - CVE-2015-8874: Stack consumption vulnerability in GD     (bsc#980375)

  - CVE-2015-8879: odbc_bindcols function in     ext/odbc/php_odbc.c mishandles driver behavior for     SQL_WVARCHAR (bsc#981050)

Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961]

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

  - CVE-2016-4073: A remote attacker could have caused     denial of service, or possibly execute arbitrary code,     due to incorrect handling of string length calculations     in mb_strcut() (bsc#977003)

  - CVE-2015-8867: The PHP function     openssl_random_pseudo_bytes() did not return     cryptographically secure random bytes (bsc#977005)

  - CVE-2016-4070: The libxml_disable_entity_loader()     setting was shared between threads, which could have     resulted in XML external entity injection and entity     expansion issues (bsc#976997)

  - CVE-2015-8866: A remote attacker could have caused     denial of service due to incorrect handling of large     strings in php_raw_url_encode() (bsc#976996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
90757	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1145-1)	Nessus	SuSE Local Security Checks	2016/4/27	2021/1/19	critical
90782	openSUSE 安全性更新：php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
91665	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
85885	PHP 5.4.x < 5.4.45 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2024/5/28	high
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/12	critical
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/7/15	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	2020/7/1	2023/4/25	critical
90757	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1145-1)	Nessus	SuSE Local Security Checks	2016/4/27	2021/1/19	critical
90782	openSUSE Security Update : php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
91665	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical

検出

プラグインの検索

critical

critical

critical

high

critical

critical

critical

critical

critical

critical