This update for libqt5-qtbase fixes the following issues :

  - boo#865241: disable RC4 based ciphers which are now     considered insecure

The following non-security bugs were fixed :

  - boo#957006: dolphin freeze when opening a folder     containing symlinks to special files

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Zend/zend_exceptions.c in PHP, possibly 5.x before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (infinite loop) via a     crafted Exception object in serialized data, a related     issue to CVE-2015-8876.(CVE-2016-7478)

  - ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before     7.0.11 proceeds with SplArray unserialization without     validating a return value and data type, which allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted     serialized data.(CVE-2016-7417)

  - ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x     before 5.6.18, and 7.x before 7.0.3 mishandles     zero-length uncompressed data, which allows remote     attackers to cause a denial of service (heap memory     corruption) or possibly have unspecified other impact     via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.(CVE-2016-4342)

  - The php_wddx_process_data function in ext/wddx/wddx.c     in PHP before 5.6.25 and 7.x before 7.0.10 allows     remote attackers to cause a denial of service     (segmentation fault) or possibly have unspecified other     impact via an invalid ISO 8601 time value, as     demonstrated by a wddx_deserialize call that mishandles     a dateTime element in a wddxPacket XML     documenti1/4Z(CVE-2016-7129)

  - Integer signedness error in the simplestring_addn     function in simplestring.c in xmlrpc-epi through     0.54.2, as used in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9, allows remote attackers     to cause a denial of service (heap-based buffer     overflow) or possibly have unspecified other impact via     a long first argument to the PHP xmlrpc_encode_request     function.(CVE-2016-6296)

  - ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 improperly interacts with     the unserialize implementation and garbage collection,     which allows remote attackers to cause a denial of     service (use-after-free and application crash) or     possibly have unspecified other impact via crafted     serialized data, a related issue to     CVE-2016-5773.(CVE-2016-6295)

  - ext/session/session.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 does not properly     maintain a certain hash data structure, which allows     remote attackers to cause a denial of service     (use-after-free) or possibly have unspecified other     impact via vectors related to session     deserialization.(CVE-2016-6290)

  - Integer overflow in the php_stream_zip_opener function     in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted zip:// URL.(CVE-2016-6297)

  - The phar_make_dirstream function in     ext/phar/dirstream.c in PHP before 5.6.18 and 7.x     before 7.0.3 mishandles zero-size ././@LongLink files,     which allows remote attackers to cause a denial of     service (uninitialized pointer dereference) or possibly     have unspecified other impact via a crafted TAR     archive.(CVE-2016-4343)

  - ext/intl/msgformat/msgformat_format.c in PHP before     5.6.26 and 7.x before 7.0.11 does not properly restrict     the locale length provided to the Locale class in the     ICU library, which allows remote attackers to cause a     denial of service (application crash) or possibly have     unspecified other impact via a     MessageFormatter::formatMessage call with a long first     argument.(CVE-2016-7416)

  - ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before     7.0.10 allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or possibly have unspecified other impact via a     malformed wddxPacket XML document that is mishandled in     a wddx_deserialize call, as demonstrated by a tag that     lacks a i1/4oe (less than) character.(CVE-2016-7131)

  - ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before     7.0.10 allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or possibly have unspecified other impact via an     invalid wddxPacket XML document that is mishandled in a     wddx_deserialize call, as demonstrated by a stray     element inside a boolean element, leading to incorrect     pop processing.(CVE-2016-7132)

  - The php_wddx_pop_element function in ext/wddx/wddx.c in     PHP before 5.6.25 and 7.x before 7.0.10 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) or possibly have     unspecified other impact via an invalid base64 binary     value, as demonstrated by a wddx_deserialize call that     mishandles a binary element in a wddxPacket XML     documenti1/4Z( CVE-2016-7130)

  - The imagegammacorrect function in ext/gd/gd.c in PHP     before 5.6.25 and 7.x before 7.0.10 does not properly     validate gamma values, which allows remote attackers to     cause a denial of service (out-of-bounds write) or     possibly have unspecified other impact by providing     different signs for the second and third     arguments.(CVE-2016-7127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2984-1 advisory.

    It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

    Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip     archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078)

    It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

    It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2016-4070)

    It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

    It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

    It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

    It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.
    (CVE-2016-4342, CVE-2016-4343)

    It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    (CVE-2016-4537, CVE-2016-4538)

    It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4539)

    It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
    (CVE-2016-4540, CVE-2016-4541)

    It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542,     CVE-2016-4543, CVE-2016-4544)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

Security issues fixed :

  - CVE-2016-4346: heap overflow in ext/standard/string.c     (bsc#977994)

  - CVE-2016-4342: heap corruption in tar/zip/phar parser     (bsc#977991)

  - CVE-2016-4537, CVE-2016-4538: bcpowmod accepts negative     scale causing heap buffer overflow corrupting _one_     definition (bsc#978827)

  - CVE-2016-4539: Malformed input causes segmentation fault     in xml_parse_into_struct() function (bsc#978828)

  - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read     in zif_grapheme_stripos when given negative offset     (bsc#978829)

  - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544:
    Out-of-bounds heap memory read in exif_read_data()     caused by malformed input (bsc#978830)

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function (bsc#980366)

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c (bsc#980373)

  - CVE-2015-8874: Stack consumption vulnerability in GD     (bsc#980375)

This update was imported from the SUSE:SLE-12:Update update project.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.18. It is, therefore, affected by multiple vulnerabilities :

  - The Perl-Compatible Regular Expressions (PCRE) library     is affected by multiple vulnerabilities related to the     handling of regular expressions, subroutine calls, and     binary files. A remote attacker can exploit these to     cause a denial of service, obtain sensitive information,     or have other unspecified impact. (CVE-2015-8383,     CVE-2015-8386, CVE-2015-8387, CVE-2015-8389,     CVE-2015-8390, CVE-2015-8391, CVE-2015-8393,     CVE-2015-8394)

  - A flaw exists in file ext/standard/exec.c in the     escapeshellcmd() and escapeshellarg() functions due to     the program truncating NULL bytes in strings. A remote     attacker can exploit this to bypass restrictions.

  - A flaw exists in file ext/standard/streamsfuncs.c in the     stream_get_meta_data() function due to a failure to     restrict writing user-supplied data to fields not     already set. A remote attacker can exploit this to     falsify the output of the function, resulting in the     insertion of malicious metadata.

  - A type confusion error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when deserializing     WDDX packets. A remote attacker can exploit this to have     an unspecified impact.

  - A flaw exists in file ext/phar/phar_object.c in the     PharFileInfo::getContent() method due to the use of     uninitialized memory causing improper validation of     user-supplied input. A remote attacker can exploit this     to corrupt memory, resulting in a denial of service or     the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in file     ext/phar/tar.c in the phar_tar_setupmetadata() function     when parsing metadata from a crafted TAR file. A remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in file     ext/standard/iptc.c in the iptcembed() function due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service or the     execution of arbitrary code.

  - An overflow condition exists in file ext/phar/tar.c in     the phar_parse_tarfile() function due to improper     validation of user-supplied input when decompressing     TAR files. A remote attacker can exploit this to cause     a stack-based buffer overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-2554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
89093	openSUSE Security Update : libqt5-qtbase (openSUSE-2016-613)	Nessus	SuSE Local Security Checks	2016/3/3	2021/1/19	critical
99914	EulerOS 2.0 SP1 : php (EulerOS-SA-2017-1067)	Nessus	Huawei Local Security Checks	2017/5/2	2025/12/22	critical
99915	EulerOS 2.0 SP2 : php (EulerOS-SA-2017-1068)	Nessus	Huawei Local Security Checks	2017/5/2	2025/12/22	critical
91320	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-2984-1)	Nessus	Ubuntu Local Security Checks	2016/5/25	2025/9/3	critical
91531	openSUSE Security Update : php5 (openSUSE-2016-696)	Nessus	SuSE Local Security Checks	2016/6/9	2021/1/19	critical
88694	PHP 5.6.x < 5.6.18 Multiple Vulnerabilities	Nessus	CGI abuses	2016/2/11	2025/5/26	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical