Stefan Esser discovered multiple vulnerabilities in the 'Month of PHP bugs'.

The substr_compare() function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. (CVE-2007-1375)

The shared memory (shmop) functions did not verify resource types, thus they could be called with a wrong resource type that might contain user-supplied data. This could be exploited to read and write arbitrary memory addresses of the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1376)

The php_binary handler of the session extension was missing a boundary check. When unserializing overly long variable names this could be exploited to read up to 126 bytes of memory, which might lead to information disclosure. (CVE-2007-1380)

The internal array_user_key_compare() function, as used for example by the PHP function uksort(), incorrectly handled memory unreferencing of its arguments. This could have been exploited to execute arbitrary code with the privileges of the PHP interpreter, and thus circumventing any disable_functions, open_basedir, or safe_mode restrictions. (CVE-2007-1484)

The session_regenerate_id() function did not properly clean up the former session identifier variable. This could be exploited to crash the PHP interpreter, possibly also remotely. (CVE-2007-1521)

Under certain conditions the mb_parse_str() could cause the register_globals configuration option to become permanently enabled.
This opened an attack vector for a large and common class of vulnerabilities. (CVE-2007-1583)

The session extension did not set the correct reference count value for the session variables. By unsetting _SESSION and HTTP_SESSION_VARS (or tricking a PHP script into doing that) this could be exploited to execute arbitrary code with the privileges of the PHP interpreter.
This issue does not affect Ubuntu 7.04. (CVE-2007-1700)

The mail() function did not correctly escape control characters in multiline email headers. This could be remotely exploited to inject arbitrary email headers. (CVE-2007-1718)

The php_stream_filter_create() function had an off-by-one buffer overflow in the handling of wildcards. This could be exploited to remotely crash the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1824)

When calling the sqlite_udf_decode_binary() with special arguments, a buffer overflow happened. Depending on the application this could be locally or remotely exploited to execute arbitrary code with the privileges of the PHP interpreter. (CVE-2007-1887 CVE-2007-1888)

The FILTER_VALIDATE_EMAIL filter extension used a wrong regular expression that allowed injecting a newline character at the end of the email string. This could be exploited to inject arbitrary email headers. This issue only affects Ubuntu 7.04. (CVE-2007-1900).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in sqlite could allow context-dependent attackers to execute arbitrary code via an empty value of the 'in' parameter.

Updated packages have been patched to correct this issue.

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.  Such versions may be affected by several buffer overflows. 

To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script on the remote server or to manipulate several variables processed by some PHP functions such as 'htmlentities().'

バナーによると、リモートホストにインストールされている PHP 5.x のバージョンは、5.2 より前です。このようなバージョンは、いくつかのバッファオーバーフローの影響を受けることがあります。 

これらの問題を悪用するには、攻撃者に、リモートサーバーで任意の PHP スクリプトをアップロードするため、または「htmlentities()」などのいくつかの PHP の関数で処理された複数の変数を操作するための能力が、必要です。

根据其标题，远程主机上安装的 PHP 5.x 版本低于 5.2。此类版本可能会受到多个缓冲区溢出的影响。 

为利用这些问题，攻击者需要能够在远程服务器上上传任意 PHP 脚本或操纵由“htmlentities()”等 PHP 函数处理的多个变量。

根據其標題，遠端主機上安裝的 PHP 5.x 版本比 5.2 舊。這些版本可能受到多個緩衝區溢位影響。 

若要惡意利用這些問題，攻擊者需要可以將任意 PHP 指令碼上傳至遠端伺服器，或可以操作由 PHP 函數 (如「htmlentities()」) 處理的一些變數。

 According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.0.  Such versions may be affected by several buffer overflows To exploit these issues, an attacker would need the ability to upload an arbitrary PHP script to the remote server, or to be able to manipulate several variables processed by some PHP functions such as htmlentities(). 

ID	名前	製品	ファミリー	公開日	更新日	深刻度
28053	Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-455-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
25114	Mandrake Linux Security Advisory : sqlite (MDKSA-2007:091)	Nessus	Mandriva Local Security Checks	2007/4/30	2021/1/6	high
31649	PHP 5.x < 5.2 Multiple Vulnerabilities	Nessus	CGI abuses	2008/3/25	2025/5/26	high
31649	PHP 5.x < 5.2 の複数の脆弱性	Nessus	CGI abuses	2008/3/25	2025/5/26	high
31649	PHP 5.x < 5.2 多个漏洞	Nessus	CGI abuses	2008/3/25	2025/5/26	high
31649	PHP 5.x < 5.2 多個弱點	Nessus	CGI abuses	2008/3/25	2025/5/26	high
4444	PHP 5.x < 5.2.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2008/3/25	2019/3/6	high

検出

プラグインの検索

high

high

high

high

high

high

high