Vulnerabilities > CVE-2011-4885 - Improper Input Validation vulnerability in PHP

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

network

low complexity

php

CWE-20

nessus

exploit available

metasploit

NVD

Published: 2011-12-30

Updated: 2018-01-09

Summary

PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP 5.0.0 PHP PHP 5.0.1 PHP PHP 5.0.2 PHP PHP 5.0.3 PHP PHP 5.0.4 PHP PHP 5.0.5 PHP PHP 5.1.1 PHP PHP 5.1.2 PHP PHP 5.1.3 PHP PHP 5.1.4 PHP PHP 5.1.5 PHP PHP 5.1.6 PHP PHP 5.2.0 PHP PHP 5.2.1 PHP PHP 5.2.2 PHP PHP 5.2.3 PHP PHP 5.2.4 PHP PHP 5.2.5 PHP PHP 5.2.6 PHP PHP 5.2.7 PHP PHP 5.2.8 PHP PHP 5.2.9 PHP PHP 5.2.10 PHP PHP 5.2.11 PHP PHP 5.2.12 PHP PHP 5.2.14 PHP PHP 5.2.15 PHP PHP 5.2.16 PHP PHP 5.2.17 PHP PHP 5.3.0 PHP PHP 5.3.1 PHP PHP 5.3.2 PHP PHP 5.3.3 PHP PHP 5.3.4 PHP PHP 5.3.5 PHP PHP 5.3.6 PHP PHP 5.3.7 PHP PHP - PHP PHP 0.1 PHP PHP 0.1.1 PHP PHP 0.2 PHP PHP 0.2.0 PHP PHP 0.2.1 PHP PHP 0.2.2 PHP PHP 0.2.3 PHP PHP 0.2.4 PHP PHP 0.3 PHP PHP 0.4 PHP PHP 0.5 PHP PHP 0.5.2 PHP PHP 0.5.3 PHP PHP 0.6 PHP PHP 0.7 PHP PHP 0.9 PHP PHP 0.9.0 PHP PHP 0.9.1 PHP PHP 0.9.2 PHP PHP 0.9.3 PHP PHP 0.9.4 PHP PHP 0.10 PHP PHP 0.11 PHP PHP 0.90 PHP PHP 0.91 PHP PHP 1.0 PHP PHP 1.0.0 PHP PHP 1.0.1 PHP PHP 1.0.2 PHP PHP 1.0.3 PHP PHP 1.0.4 PHP PHP 1.1 PHP PHP 1.1.0 PHP PHP 1.1.1 PHP PHP 1.2 PHP PHP 1.2.0 PHP PHP 1.2.1 PHP PHP 1.2.2 PHP PHP 1.2.3 PHP PHP 1.2.4 PHP PHP 1.2.5 PHP PHP 1.3 PHP PHP 1.3.1 PHP PHP 1.3.5 PHP PHP 1.4 PHP PHP 1.5 PHP PHP 2.0 PHP PHP 2.0.0 PHP PHP 2.0.1 PHP PHP 2.0.2 PHP PHP 2.0B10 PHP PHP 3.0 PHP PHP 3.0.1 PHP PHP 3.0.2 PHP PHP 3.0.3 PHP PHP 3.0.4 PHP PHP 3.0.5 PHP PHP 3.0.6 PHP PHP 3.0.7 PHP PHP 3.0.8 PHP PHP 3.0.9 PHP PHP 3.0.10 PHP PHP 3.0.11 PHP PHP 3.0.12 PHP PHP 3.0.13 PHP PHP 3.0.14 PHP PHP 3.0.15 PHP PHP 3.0.16 PHP PHP 3.0.17 PHP PHP 3.0.18 PHP PHP 4.0 PHP PHP 4.0.0 PHP PHP 4.0.1 PHP PHP 4.0.2 PHP PHP 4.0.3 PHP PHP 4.0.4 PHP PHP 4.0.5 PHP PHP 4.0.6 PHP PHP 4.0.7 PHP PHP 4.1.0 PHP PHP 4.1.1 PHP PHP 4.1.2 PHP PHP 4.1.3 PHP PHP 4.2 PHP PHP 4.2.0 PHP PHP 4.2.1 PHP PHP 4.2.2 PHP PHP 4.2.3 PHP PHP 4.2.4 PHP PHP 4.3 PHP PHP 4.3.0 PHP PHP 4.3.1 PHP PHP 4.3.2 PHP PHP 4.3.3 PHP PHP 4.3.4 PHP PHP 4.3.5 PHP PHP 4.3.6 PHP PHP 4.3.7 PHP PHP 4.3.8 PHP PHP 4.3.9 PHP PHP 4.3.10 PHP PHP 4.3.11 PHP PHP 4.4.0 PHP PHP 4.4.1 PHP PHP 4.4.2 PHP PHP 4.4.3 PHP PHP 4.4.4 PHP PHP 4.4.5 PHP PHP 4.4.6 PHP PHP 4.4.7 PHP PHP 4.4.8 PHP PHP 4.4.9 PHP PHP 5.1 PHP PHP 5.1.0 PHP PHP 5.2.13 PHP PHP 5.3.8	429

Common Weakness Enumeration (CWE)

CWE-20 - Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Server Side Include (SSI) Injection
An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
Cross Site Scripting through Log Files
An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
Command Line Execution through SQL Injection
An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Exploit-Db

description	PHP Hash Table Collision Proof Of Concept. CVE-2011-4885. Dos exploit for php platform
file	exploits/php/dos/18305.py
id	EDB-ID:18305
last seen	2016-02-02
modified	2012-01-03
platform	php
port
published	2012-01-03
reporter	Christian Mehlmauer
source	https://www.exploit-db.com/download/18305/
title	PHP Hash Table Collision Proof Of Concept
type	dos

description	PHP Hashtables Denial of Service. CVE-2011-4885. Dos exploit for php platform
file	exploits/php/dos/18296.txt
id	EDB-ID:18296
last seen	2016-02-02
modified	2012-01-01
platform	php
port
published	2012-01-01
reporter	infodox
source	https://www.exploit-db.com/download/18296/
title	PHP Hashtables Denial of Service
type	dos

description	MyBulletinBoard (MyBB). CVE-2006-3775,CVE-2011-4084,CVE-2011-4858,CVE-2011-4885,CVE-2011-5034,CVE-2011-5035. Webapps exploit for php platform
id	EDB-ID:2012
last seen	2016-01-31
modified	2006-07-15
published	2006-07-15
reporter	rgod
source	https://www.exploit-db.com/download/2012/
title	MyBulletinBoard MyBB <= 1.1.5 - CLIENT-IP SQL Injection Exploit

Metasploit

description	This module uses a denial-of-service (DoS) condition appearing in a variety of programming languages. This vulnerability occurs when storing multiple values in a hash table and all values have the same hash value. This can cause a web server parsing the POST parameters issued with a request into a hash table to consume hours of CPU with a single HTTP request. Currently, only the hash functions for PHP and Java are implemented. This module was tested with PHP + httpd, Tomcat, Glassfish and Geronimo. It also generates a random payload to bypass some IDS signatures.
id	MSF:AUXILIARY/DOS/HTTP/HASHCOLLISION_DOS
last seen	2020-05-21
modified	2017-07-24
published	2012-05-13
references	http://www.ocert.org/advisories/ocert-2011-003.html http://www.nruns.com/_downloads/advisory28122011.pdf http://events.ccc.de/congress/2011/Fahrplan/events/4680.en.html http://events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective_DoS_on_web_application_platforms.pdf http://www.youtube.com/watch?v=R2Cq3CLI6H8 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5034 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5035 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4858
reporter	Rapid7
source	https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/dos/http/hashcollision_dos.rb
title	Hashtable Collisions

Nessus

NASL family	MacOS X Local Security Checks
NASL id	MACOSX_10_7_4.NASL
description	The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components : - Login Window - Bluetooth - curl - HFS - Kernel - libarchive - libsecurity - libxml - LoginUIFramework - PHP - Quartz Composer - QuickTime - Ruby - Security Framework - Time Machine - X11 Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7.
last seen	2020-06-01
modified	2020-06-02
plugin id	59066
published	2012-05-10
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/59066
title	Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)
code	# # (C) Tenable Network Security, Inc. # if (!defined_func("bn_random")) exit(0); if (NASL_LEVEL < 3000) exit(0); # Avoid problems with large number of xrefs. include("compat.inc"); if (description) { script_id(59066); script_version("1.27"); script_cvs_date("Date: 2018/07/16 12:48:31"); script_cve_id( "CVE-2011-1004", "CVE-2011-1005", "CVE-2011-1777", "CVE-2011-1778", "CVE-2011-1944", "CVE-2011-2821", "CVE-2011-2834", "CVE-2011-2895", "CVE-2011-3212", "CVE-2011-3389", "CVE-2011-3919", "CVE-2011-4566", "CVE-2011-4815", "CVE-2011-4885", "CVE-2012-0036", "CVE-2012-0642", "CVE-2012-0649", "CVE-2012-0652", "CVE-2012-0654", "CVE-2012-0655", "CVE-2012-0656", "CVE-2012-0657", "CVE-2012-0658", "CVE-2012-0659", "CVE-2012-0660", "CVE-2012-0661", "CVE-2012-0662", "CVE-2012-0675", "CVE-2012-0830" ); script_bugtraq_id( 46458, 46460, 47737, 48056, 49124, 49279, 49658, 49778, 50907, 51193, 51198, 51300, 51665, 51830, 52364, 53456, 53457, 53459, 53462, 53465, 53466, 53467, 53468, 53469, 53470, 53471, 53473 ); script_xref(name:"TRA", value:"TRA-2012-02"); script_xref(name:"CERT", value:"864643"); script_xref(name:"ZDI", value:"ZDI-12-135"); script_name(english:"Mac OS X 10.7.x < 10.7.4 Multiple Vulnerabilities (BEAST)"); script_summary(english:"Check the version of Mac OS X."); script_set_attribute( attribute:"synopsis", value: "The remote host is missing a Mac OS X update that fixes several security issues." ); script_set_attribute( attribute:"description", value: "The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.4. The newer version contains numerous security-related fixes for the following components : - Login Window - Bluetooth - curl - HFS - Kernel - libarchive - libsecurity - libxml - LoginUIFramework - PHP - Quartz Composer - QuickTime - Ruby - Security Framework - Time Machine - X11 Note that this update addresses the recent FileVault password vulnerability, in which user passwords are stored in plaintext to a system-wide debug log if the legacy version of FileVault is used to encrypt user directories after a system upgrade to Lion. Since the patch only limits further exposure, though, we recommend that all users on the system change their passwords if user folders were encrypted using the legacy version of FileVault prior to and after an upgrade to OS X 10.7." ); script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2012-02"); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT5281"); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2012/May/msg00001.html"); script_set_attribute(attribute:"see_also", value:"http://www.zerodayinitiative.com/advisories/ZDI-12-135"); script_set_attribute(attribute:"see_also", value:"http://seclists.org/fulldisclosure/2012/Aug/64"); script_set_attribute(attribute:"see_also", value:"https://www.imperialviolet.org/2011/09/23/chromeandbeast.html"); script_set_attribute(attribute:"see_also", value:"https://www.openssl.org/~bodo/tls-cbc.txt"); script_set_attribute( attribute:"solution", value:"Upgrade to Mac OS X 10.7.4 or later." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"exploited_by_malware", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2011/02/18"); script_set_attribute(attribute:"patch_publication_date", value:"2012/05/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2012/05/10"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x"); script_set_attribute(attribute:"in_the_news", value:"true"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc."); script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl"); exit(0); } os = get_kb_item("Host/MacOSX/Version"); if (!os) { os = get_kb_item("Host/OS"); if (isnull(os)) exit(0, "The 'Host/OS' KB item is missing."); if ("Mac OS X" >!< os) exit(0, "The host does not appear to be running Mac OS X."); c = get_kb_item("Host/OS/Confidence"); if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence."); } if (!os) exit(0, "The host does not appear to be running Mac OS X."); if (ereg(pattern:"Mac OS X 10\.7($\|\.[0-3]([^0-9]\|$))", string:os)) security_hole(0); else exit(0, "The host is not affected as it is running "+os+".");

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20120202_PHP_ON_SL4_X.NASL
description	PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via previous php packages) introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-03-18
modified	2012-08-01
plugin id	61238
published	2012-08-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61238
title	Scientific Linux Security Update : php on SL4.x, SL5.x, SL6.x i386/x86_64 (20120202)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2012-0019.NASL
description	Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-04-16
modified	2012-01-12
plugin id	57494
published	2012-01-12
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57494
title	RHEL 5 / 6 : php53 and php (RHSA-2012:0019)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20120111_PHP53_AND_PHP_ON_SL5_X.NASL
description	PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-03-18
modified	2012-08-01
plugin id	61219
published	2012-08-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61219
title	Scientific Linux Security Update : php53 and php on SL5.x, SL6.x i386/x86_64 (20120111)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2012-065.NASL
description	Multiple vulnerabilities has been identified and fixed in php : The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server (CVE-2012-0788). Note: this was fixed with php-5.3.10 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885 (CVE-2012-0830). Note: this was fixed with php-5.3.10 PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c (CVE-2012-0831). Insufficient validating of upload name leading to corrupted $_FILES indices (CVE-2012-1172). The updated php packages have been upgraded to 5.3.11 which is not vulnerable to these issues. Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header (CVE-2012-0807). The php-suhosin packages has been upgraded to the 0.9.33 version which is not affected by this issue. Additionally some of the PECL extensions has been upgraded to their latest respective versions which resolves various upstream bugs.
last seen	2020-06-01
modified	2020-06-02
plugin id	58890
published	2012-04-27
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/58890
title	Mandriva Linux Security Advisory : php (MDVSA-2012:065)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2012-0092.NASL
description	From Red Hat Security Advisory 2012:0092 : Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0019 for php53 packages in Red Hat Enterprise Linux 5) introduced an uninitialized memory use flaw. A remote attacker could send a specially- crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68448
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68448
title	Oracle Linux 5 : php53 (ELSA-2012-0092)

NASL family	CGI abuses
NASL id	PHP_5_3_10.NASL
description	According to its banner, the version of PHP installed on the remote host is 5.3.9. This version reportedly is affected by a code execution vulnerability. Specifically, the fix for the hash collision denial of service vulnerability (CVE-2011-4885) itself has introduced a remote code execution vulnerability in the function
last seen	2020-06-01
modified	2020-06-02
plugin id	57825
published	2012-02-03
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57825
title	PHP 5.3.9 'php_register_variable_ex()' Code Execution (banner check)

NASL family	SuSE Local Security Checks
NASL id	SUSE_APACHE2-MOD_PHP5-8009.NASL
description	This update of php5 fixes multiple security flaws : - missing checks of return values could allow remote attackers to cause a denial of service (NULL pointer dereference). (CVE-2011-4153) - denial of service via hash collisions. (CVE-2011-4885) - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary content. (CVE-2012-0057) - remote attackers can cause a denial of service via specially crafted input to an application that attempts to perform Tidy::diagnose operations. (CVE-2012-0781) - applications that use a PDO driver were prone to denial of service flaws which could be exploited remotely. (CVE-2012-0788) - memory leak in the timezone functionality could allow remote attackers to cause a denial of service (memory consumption). (CVE-2012-0789) - a stack-based buffer overflow in php5
last seen	2020-06-05
modified	2012-03-26
plugin id	58480
published	2012-03-26
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/58480
title	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 8009)

NASL family	Web Servers
NASL id	HPSMH_7_1_1_1.NASL
description	According to the web server
last seen	2020-06-01
modified	2020-06-02
plugin id	59851
published	2012-07-05
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/59851
title	HP System Management Homepage < 7.1.1 Multiple Vulnerabilities

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-1358-1.NASL
description	It was discovered that PHP computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. This could allow a remote attacker to cause a denial of service by sending many crafted parameters. (CVE-2011-4885) ATTENTION: this update changes previous PHP behavior by limiting the number of external input variables to 1000. This may be increased by adding a
last seen	2020-06-01
modified	2020-06-02
plugin id	57888
published	2012-02-10
reporter	Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57888
title	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : php5 vulnerabilities (USN-1358-1)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2012-0093.NASL
description	Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0071, RHSA-2012:0033, and RHSA-2012:0019 for php packages in Red Hat Enterprise Linux 4, 5, and 6 respectively) introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	57808
published	2012-02-03
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57808
title	CentOS 4 / 5 / 6 : php (CESA-2012:0093)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2012-0092.NASL
description	Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0019 for php53 packages in Red Hat Enterprise Linux 5) introduced an uninitialized memory use flaw. A remote attacker could send a specially- crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-04-16
modified	2012-02-03
plugin id	57820
published	2012-02-03
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57820
title	RHEL 5 : php53 (RHSA-2012:0092)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20120118_PHP_ON_SL5_X.NASL
description	PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-03-18
modified	2012-08-01
plugin id	61220
published	2012-08-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61220
title	Scientific Linux Security Update : php on SL5.x i386/x86_64 (20120118)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2012-0092.NASL
description	Updated php53 packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0019 for php53 packages in Red Hat Enterprise Linux 5) introduced an uninitialized memory use flaw. A remote attacker could send a specially- crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	57807
published	2012-02-03
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57807
title	CentOS 5 : php53 (CESA-2012:0092)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20120202_PHP53_ON_SL5_X.NASL
description	PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via in a previous update for php53) introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php53 users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-03-18
modified	2012-08-01
plugin id	61237
published	2012-08-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61237
title	Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120202)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2012-0071.NASL
description	Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-06-01
modified	2020-06-02
plugin id	67087
published	2013-06-29
reporter	This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/67087
title	CentOS 4 : php (CESA-2012:0071)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2012-0019.NASL
description	From Red Hat Security Advisory 2012:0019 : Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68431
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68431
title	Oracle Linux 5 / 6 : php / php53 (ELSA-2012-0019)

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-1358-2.NASL
description	USN 1358-1 fixed multiple vulnerabilities in PHP. The fix for CVE-2012-0831 introduced a regression where the state of the magic_quotes_gpc setting was not correctly reflected when calling the ini_get() function. We apologize for the inconvenience. It was discovered that PHP computed hash values for form parameters without restricting the ability to trigger hash collisions predictably. This could allow a remote attacker to cause a denial of service by sending many crafted parameters. (CVE-2011-4885) ATTENTION: this update changes previous PHP behavior by limiting the number of external input variables to 1000. This may be increased by adding a
last seen	2020-06-01
modified	2020-06-02
plugin id	57932
published	2012-02-14
reporter	Ubuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57932
title	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : php5 regression (USN-1358-2)

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201209-03.NASL
description	The remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, create arbitrary files, conduct directory traversal attacks, bypass protection mechanisms, or perform further attacks with unspecified impact. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	62236
published	2012-09-24
reporter	This script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/62236
title	GLSA-201209-03 : PHP: Multiple vulnerabilities

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2012-0033.NASL
description	From Red Hat Security Advisory 2012:0033 : Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-06-01
modified	2020-06-02
plugin id	68432
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68432
title	Oracle Linux 5 : php (ELSA-2012-0033)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2012-182.NASL
description	php5 security update
last seen	2020-06-05
modified	2014-06-13
plugin id	74580
published	2014-06-13
reporter	This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/74580
title	openSUSE Security Update : php5 (openSUSE-SU-2012:0426-1)

NASL family	CGI abuses
NASL id	PHP_5_3_9.NASL
description	According to its banner, the version of PHP installed on the remote host is older than 5.3.9. As such, it may be affected by the following security issues : - The
last seen	2020-06-01
modified	2020-06-02
plugin id	57537
published	2012-01-13
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57537
title	PHP < 5.3.9 Multiple Vulnerabilities

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2012-0093.NASL
description	From Red Hat Security Advisory 2012:0093 : Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0071, RHSA-2012:0033, and RHSA-2012:0019 for php packages in Red Hat Enterprise Linux 4, 5, and 6 respectively) introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	68449
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68449
title	Oracle Linux 4 / 5 / 6 : php (ELSA-2012-0093)

NASL family	SuSE Local Security Checks
NASL id	SUSE_11_APACHE2-MOD_PHP5-120309.NASL
description	This update of php5 fixes multiple security flaws : - A php5 upload filename injection was fixed. (CVE-2011-2202) - A integer overflow in the EXIF extension was fixed that could be used by attackers to crash the interpreter or potentially read memory. (CVE-2011-4566) - Multiple NULL pointer dereferences were fixed that could lead to crashes. (CVE-2011-3182) - An integer overflow in the PHP calendar extension was fixed that could have led to crashes. (CVE-2011-1466) - A symlink vulnerability in the PEAR installer could be exploited by local attackers to inject code. (CVE-2011-1072) - missing checks of return values could allow remote attackers to cause a denial of service (NULL pointer dereference). (CVE-2011-4153) - denial of service via hash collisions. (CVE-2011-4885) - specially crafted XSLT stylesheets could allow remote attackers to create arbitrary files with arbitrary content. (CVE-2012-0057) - remote attackers can cause a denial of service via specially crafted input to an application that attempts to perform Tidy::diagnose operations. (CVE-2012-0781) - applications that use a PDO driver were prone to denial of service flaws which could be exploited remotely. (CVE-2012-0788) - memory leak in the timezone functionality could allow remote attackers to cause a denial of service (memory consumption). (CVE-2012-0789) - a stack-based buffer overflow in the php5 Suhosin extension could allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header. (CVE-2012-0807) - this fixes an incorrect fix for CVE-2011-4885 which could allow remote attackers to execute arbitrary code via a request containing a large number of variables. (CVE-2012-0830) - temporary changes to the magic_quotes_gpc directive during the importing of environment variables is not properly performed which makes it easier for remote attackers to conduct SQL injections. (CVE-2012-0831) Also the following bugs have been fixed : - allow uploading files bigger than 2GB for 64bit systems [bnc#709549] - amend README.SUSE to discourage using apache module with apache2-worker [bnc#728671]
last seen	2020-06-05
modified	2012-04-13
plugin id	58740
published	2012-04-13
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/58740
title	SuSE 11.1 Security Update : PHP5 (SAT Patch Number 5964)

NASL family	Mandriva Local Security Checks
NASL id	MANDRIVA_MDVSA-2011-197.NASL
description	Multiple vulnerabilities has been discovered and corrected in php : Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708 (CVE-2011-4566). PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters (CVE-2011-4885). The updated packages have been patched to correct this issue.
last seen	2020-06-01
modified	2020-06-02
plugin id	57427
published	2012-01-03
reporter	This script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/57427
title	Mandriva Linux Security Advisory : php (MDVSA-2011:197)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2012-0019.NASL
description	Updated php53 and php packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) Red Hat would like to thank oCERT for reporting CVE-2011-4885. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4885. All php53 and php users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-06-01
modified	2020-06-02
plugin id	57488
published	2012-01-12
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57488
title	CentOS 5 / 6 : php / php53 (CESA-2012:0019)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2012-1262.NASL
description	This update has the latest release of PHP, 5.3.10, which fixes a security issue. A previous security fix introduced in PHP 5.3.9 allowed a remote user to crash the PHP interpreter, or possibly execute arbitrary code. (CVE-2012-0830) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2012-02-09
plugin id	57869
published	2012-02-09
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57869
title	Fedora 16 : maniadrive-1.2-32.fc16.2 / php-5.3.10-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.2 (2012-1262)

NASL family	CGI abuses
NASL id	PHP_5_3_9_ACE.NASL
description	The remote host is running a version of PHP that is affected by an arbitrary code execution vulnerability. Specifically, the fix for the hash collision denial of service vulnerability (CVE-2011-4885) introduces a remote code execution vulnerability in the function
last seen	2020-06-01
modified	2020-06-02
plugin id	58039
published	2012-02-20
reporter	This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/58039
title	PHP 5.3.9 'php_register_variable_ex()' Code Execution (intrusive check)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2012-0093.NASL
description	Updated php packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the fix for CVE-2011-4885 (released via RHSA-2012:0071, RHSA-2012:0033, and RHSA-2012:0019 for php packages in Red Hat Enterprise Linux 4, 5, and 6 respectively) introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code. (CVE-2012-0830) All php users should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.
last seen	2020-04-16
modified	2012-02-03
plugin id	57821
published	2012-02-03
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57821
title	RHEL 4 / 5 / 6 : php (RHSA-2012:0093)

NASL family	Scientific Linux Local Security Checks
NASL id	SL_20120130_PHP_ON_SL4_X.NASL
description	PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-03-18
modified	2012-08-01
plugin id	61227
published	2012-08-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/61227
title	Scientific Linux Security Update : php on SL4.x i386/x86_64 (20120130)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2012-0071.NASL
description	Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-04-16
modified	2012-01-31
plugin id	57748
published	2012-01-31
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57748
title	RHEL 4 : php (RHSA-2012:0071)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2012-0033.NASL
description	Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-04-16
modified	2012-01-19
plugin id	57594
published	2012-01-19
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57594
title	RHEL 5 : php (RHSA-2012:0033)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-2399.NASL
description	Several vulnerabilities have been discovered in PHP, the web scripting language. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2011-1938 The UNIX socket handling allowed attackers to trigger a buffer overflow via a long path name. - CVE-2011-2483 The crypt_blowfish function did not properly handle 8-bit characters, which made it easier for attackers to determine a cleartext password by using knowledge of a password hash. - CVE-2011-4566 When used on 32 bit platforms, the exif extension could be used to trigger an integer overflow in the exif_process_IFD_TAG function when processing a JPEG file. - CVE-2011-4885 It was possible to trigger hash collisions predictably when parsing form parameters, which allows remote attackers to cause a denial of service by sending many crafted parameters. - CVE-2012-0057 When applying a crafted XSLT transform, an attacker could write files to arbitrary places in the filesystem. NOTE: the fix for CVE-2011-2483 required changing the behaviour of this function: it is now incompatible with some old (wrongly) generated hashes for passwords containing 8-bit characters. See the package NEWS entry for details. This change has not been applied to the Lenny version of PHP.
last seen	2020-03-17
modified	2012-02-01
plugin id	57753
published	2012-02-01
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57753
title	Debian DSA-2399-2 : php5 - several vulnerabilities

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2012-41.NASL
description	It was discovered that the fix for CVE-2011-4885 introduced an uninitialized memory use flaw. A remote attacker could send a specially crafted HTTP request to cause the PHP interpreter to crash or, possibly, execute arbitrary code.
last seen	2020-06-01
modified	2020-06-02
plugin id	69648
published	2013-09-04
reporter	This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/69648
title	Amazon Linux AMI : php (ALAS-2012-41)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL13519.NASL
description	PHP has been cited with the following multiple vulnerabilities, which may be locally exploitable on some F5 products : CVE-2006-7243 PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists function. CVE-2007-3799 The session_start function in ext/session in PHP 4.x up to 4.4.7 and 5.x up to 5.2.3 allows remote attackers to insert arbitrary attributes into the session cookie via special characters in a cookie that is obtained from (1) PATH_INFO, (2) the session_id function, and (3) the session_start function, which are not encoded or filtered when the new session cookie is generated, a related issue to CVE-2006-0207. CVE-2010-3710 Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string. CVE-2010-3870 The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string. CVE-2010-4697 Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow context-dependent attackers to cause a denial of service (heap memory corruption) or have unspecified other impact via vectors related to use of __set, __get, __isset, and __unset methods on objects accessed by a reference. CVE-2011-1470 The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function. CVE-2011-3182 PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function. CVE-2011-3267 PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers to cause a denial of service (application crash) via unspecified vectors. CVE-2011-3268 Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483. CVE-2011-4566 Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in a JPEG file, a different vulnerability than CVE-2011-0708. CVE-2012-0830 The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
last seen	2020-06-01
modified	2020-06-02
plugin id	78134
published	2014-10-10
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/78134
title	F5 Networks BIG-IP : Multiple PHP vulnerabilities (K13519)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2012-0504.NASL
description	Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566) Full upstream changelog : http://www.php.net/ChangeLog-5.php#5.3.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2012-01-20
plugin id	57609
published	2012-01-20
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57609
title	Fedora 16 : maniadrive-1.2-32.fc16.1 / php-5.3.9-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.1 (2012-0504)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2012-0420.NASL
description	Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566) Full upstream changelog : http://www.php.net/ChangeLog-5.php#5.3.9 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2012-01-27
plugin id	57703
published	2012-01-27
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57703
title	Fedora 15 : maniadrive-1.2-32.fc15.1 / php-5.3.9-1.fc15 / php-eaccelerator-0.9.6.1-9.fc15.1 (2012-0420)

NASL family	Fedora Local Security Checks
NASL id	FEDORA_2012-1301.NASL
description	This update contains the latest release of PHP, 5.3.10, which fixes a security issue. A security fix introduced in PHP 5.3.9 allowed a remote user to crash the PHP interpreter, or possibly, execute arbitrary code. (CVE-2012-0830) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-03-17
modified	2012-02-15
plugin id	57954
published	2012-02-15
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57954
title	Fedora 15 : maniadrive-1.2-32.fc15.2 / php-5.3.10-1.fc15 / php-eaccelerator-0.9.6.1-9.fc15.2 (2012-1301)

NASL family	F5 Networks Local Security Checks
NASL id	F5_BIGIP_SOL13588.NASL
description	PHP versions prior to 5.3.9 compute hash values for form parameters without restricting the ability to trigger hash collisions predictably, which may allow remote attackers to cause a denial of service (DoS) (CPU consumption) by sending many crafted parameters. (CVE-2011-4885)
last seen	2020-06-01
modified	2020-06-02
plugin id	78135
published	2014-10-10
reporter	This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/78135
title	F5 Networks BIG-IP : PHP vulnerability (K13588)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2012-0033.NASL
description	Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) A use-after-free flaw was found in the PHP substr_replace() function. If a PHP script used the same variable as multiple function arguments, a remote attacker could possibly use this to crash the PHP interpreter or, possibly, execute arbitrary code. (CVE-2011-1148) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) A bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL to connect to. (CVE-2011-1469) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-06-01
modified	2020-06-02
plugin id	57642
published	2012-01-24
reporter	This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57642
title	CentOS 5 : php (CESA-2012:0033)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2012-0071.NASL
description	From Red Hat Security Advisory 2012:0071 : Updated php packages that fix several security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566) An insufficient input validation flaw, leading to a buffer over-read, was found in the PHP exif extension. A specially crafted image file could cause the PHP interpreter to crash when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-0708) An integer overflow flaw was found in the PHP calendar extension. A remote attacker able to make a PHP script call SdnToJulian() with a large value could cause the PHP interpreter to crash. (CVE-2011-1466) An off-by-one flaw was found in PHP. If an attacker uploaded a file with a specially crafted file name it could cause a PHP script to attempt to write a file to the root (/) directory. By default, PHP runs as the
last seen	2020-06-01
modified	2020-06-02
plugin id	68442
published	2013-07-12
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/68442
title	Oracle Linux 4 : php (ELSA-2012-0071)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2012-37.NASL
description	It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000. (CVE-2011-4885) An integer overflow flaw was found in the PHP exif extension. On 32-bit systems, a specially crafted image file could cause the PHP interpreter to crash or disclose portions of its memory when a PHP script tries to extract Exchangeable image file format (Exif) metadata from the image file. (CVE-2011-4566)
last seen	2020-06-01
modified	2020-06-02
plugin id	69644
published	2013-09-04
reporter	This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/69644
title	Amazon Linux AMI : php (ALAS-2012-37)

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_D39218103C8011E197E800215C6A37BB.NASL
description	php development team reports : Security Enhancements and Fixes in PHP 5.3.9 : - Added max_input_vars directive to prevent attacks based on hash collisions. (CVE-2011-4885) - Fixed bug #60150 (Integer overflow during the parsing of invalid exif header). (CVE-2011-4566)
last seen	2020-06-01
modified	2020-06-02
plugin id	57489
published	2012-01-12
reporter	This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/57489
title	FreeBSD : php -- multiple vulnerabilities (d3921810-3c80-11e1-97e8-00215c6a37bb)

Packetstorm

data source	https://packetstormsecurity.com/files/download/108287/cve-2011-4885_hashtables_exploit.txt
id	PACKETSTORM:108287
last seen	2016-12-05
published	2012-01-01
reporter	infodox
source	https://packetstormsecurity.com/files/108287/PHP-5.3.x-Hashtables-Proof-Of-Concept.html
title	PHP 5.3.x Hashtables Proof Of Concept

data source	https://packetstormsecurity.com/files/download/108294/HashtablePOC.py.txt
id	PACKETSTORM:108294
last seen	2016-12-05
published	2012-01-02
reporter	FireFart
source	https://packetstormsecurity.com/files/108294/PHP-5.3.x-Hash-Collision-Proof-Of-Concept-Code.html
title	PHP 5.3.x Hash Collision Proof Of Concept Code

Redhat

advisories

bugzilla

id	758413
title	CVE-2011-4566 php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment php53-xml is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019001
comment php53-xml is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196028
AND
comment php53-bcmath is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019003
comment php53-bcmath is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196026
AND
comment php53-mbstring is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019005
comment php53-mbstring is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196040
AND
comment php53-cli is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019007
comment php53-cli is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196032
AND
comment php53-pgsql is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019009
comment php53-pgsql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196024
AND
comment php53-pspell is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019011
comment php53-pspell is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196038
AND
comment php53-xmlrpc is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019013
comment php53-xmlrpc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196034
AND
comment php53-pdo is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019015
comment php53-pdo is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196036
AND
comment php53-dba is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019017
comment php53-dba is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196002
AND
comment php53-process is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019019
comment php53-process is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196012
AND
comment php53-devel is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019021
comment php53-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196004
AND
comment php53 is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019023
comment php53 is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196006
AND
comment php53-odbc is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019025
comment php53-odbc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196042
AND
comment php53-mysql is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019027
comment php53-mysql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196008
AND
comment php53-imap is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019029
comment php53-imap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196016
AND
comment php53-common is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019031
comment php53-common is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196018
AND
comment php53-ldap is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019033
comment php53-ldap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196020
AND
comment php53-snmp is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019035
comment php53-snmp is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196010
AND
comment php53-soap is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019037
comment php53-soap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196022
AND
comment php53-intl is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019039
comment php53-intl is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196014
AND
comment php53-gd is earlier than 0:5.3.3-1.el5_7.5
oval oval:com.redhat.rhsa:tst:20120019041
comment php53-gd is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20110196030

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment php-cli is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019044
comment php-cli is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195002
AND
comment php-odbc is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019046
comment php-odbc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195004
AND
comment php-ldap is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019048
comment php-ldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195012
AND
comment php-common is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019050
comment php-common is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195014
AND
comment php-gd is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019052
comment php-gd is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195008
AND
comment php is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019054
comment php is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195018
AND
comment php-pdo is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019056
comment php-pdo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195024
AND
comment php-xmlrpc is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019058
comment php-xmlrpc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195016
AND
comment php-xml is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019060
comment php-xml is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195020
AND
comment php-soap is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019062
comment php-soap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195010
AND
comment php-pgsql is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019064
comment php-pgsql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195022
AND
comment php-mysql is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019066
comment php-mysql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195006
AND
comment php-tidy is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019068
comment php-tidy is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195036
AND
comment php-imap is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019070
comment php-imap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195040
AND
comment php-recode is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019072
comment php-recode is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195042
AND
comment php-snmp is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019074
comment php-snmp is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195038
AND
comment php-embedded is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019076
comment php-embedded is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195046
AND
comment php-intl is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019078
comment php-intl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195050
AND
comment php-bcmath is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019080
comment php-bcmath is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195048
AND
comment php-mbstring is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019082
comment php-mbstring is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195044
AND
comment php-devel is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019084
comment php-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195052
AND
comment php-process is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019086
comment php-process is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195028
AND
comment php-enchant is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019088
comment php-enchant is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195030
AND
comment php-dba is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019090
comment php-dba is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195034
AND
comment php-pspell is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019092
comment php-pspell is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195026
AND
comment php-zts is earlier than 0:5.3.3-3.el6_2.5
oval oval:com.redhat.rhsa:tst:20120019094
comment php-zts is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195032

rhsa

id	RHSA-2012:0019
released	2012-01-11
severity	Moderate
title	RHSA-2012:0019: php53 and php security update (Moderate)

bugzilla

id	758413
title	CVE-2011-4566 php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment php-odbc is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033001
comment php-odbc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082010
AND
comment php-bcmath is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033003
comment php-bcmath is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082006
AND
comment php is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033005
comment php is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082022
AND
comment php-xmlrpc is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033007
comment php-xmlrpc is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082036
AND
comment php-cli is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033009
comment php-cli is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082030
AND
comment php-mysql is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033011
comment php-mysql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082024
AND
comment php-pgsql is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033013
comment php-pgsql is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082028
AND
comment php-soap is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033015
comment php-soap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082034
AND
comment php-mbstring is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033017
comment php-mbstring is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082014
AND
comment php-dba is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033019
comment php-dba is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082032
AND
comment php-xml is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033021
comment php-xml is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082008
AND
comment php-pdo is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033023
comment php-pdo is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082026
AND
comment php-ldap is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033025
comment php-ldap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082012
AND
comment php-gd is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033027
comment php-gd is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082018
AND
comment php-ncurses is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033029
comment php-ncurses is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082016
AND
comment php-imap is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033031
comment php-imap is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082004
AND
comment php-snmp is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033033
comment php-snmp is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082002
AND
comment php-devel is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033035
comment php-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082020
AND
comment php-common is earlier than 0:5.1.6-27.el5_7.4
oval oval:com.redhat.rhsa:tst:20120033037
comment php-common is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20070082038

rhsa

id	RHSA-2012:0033
released	2012-01-18
severity	Moderate
title	RHSA-2012:0033: php security update (Moderate)

bugzilla

id	758413
title	CVE-2011-4566 php: integer overflow in exif_process_IFD_TAG() may lead to DoS or arbitrary memory disclosure

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment php-odbc is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071001
comment php-odbc is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276008
AND
comment php-pgsql is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071003
comment php-pgsql is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276004
AND
comment php-xmlrpc is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071005
comment php-xmlrpc is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276006
AND
comment php-snmp is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071007
comment php-snmp is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276014
AND
comment php-mysql is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071009
comment php-mysql is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276010
AND
comment php is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071011
comment php is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276012
AND
comment php-mbstring is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071013
comment php-mbstring is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276020
AND
comment php-gd is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071015
comment php-gd is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276026
AND
comment php-ldap is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071017
comment php-ldap is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276024
AND
comment php-devel is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071019
comment php-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276028
AND
comment php-ncurses is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071021
comment php-ncurses is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276016
AND
comment php-imap is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071023
comment php-imap is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276002
AND
comment php-pear is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071025
comment php-pear is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276018
AND
comment php-domxml is earlier than 0:4.3.9-3.35
oval oval:com.redhat.rhsa:tst:20120071027
comment php-domxml is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20060276022

rhsa

id	RHSA-2012:0071
released	2012-01-30
severity	Moderate
title	RHSA-2012:0071: php security update (Moderate)

rpms

php-0:5.3.3-3.el6_2.5
php-bcmath-0:5.3.3-3.el6_2.5
php-cli-0:5.3.3-3.el6_2.5
php-common-0:5.3.3-3.el6_2.5
php-dba-0:5.3.3-3.el6_2.5
php-debuginfo-0:5.3.3-3.el6_2.5
php-devel-0:5.3.3-3.el6_2.5
php-embedded-0:5.3.3-3.el6_2.5
php-enchant-0:5.3.3-3.el6_2.5
php-gd-0:5.3.3-3.el6_2.5
php-imap-0:5.3.3-3.el6_2.5
php-intl-0:5.3.3-3.el6_2.5
php-ldap-0:5.3.3-3.el6_2.5
php-mbstring-0:5.3.3-3.el6_2.5
php-mysql-0:5.3.3-3.el6_2.5
php-odbc-0:5.3.3-3.el6_2.5
php-pdo-0:5.3.3-3.el6_2.5
php-pgsql-0:5.3.3-3.el6_2.5
php-process-0:5.3.3-3.el6_2.5
php-pspell-0:5.3.3-3.el6_2.5
php-recode-0:5.3.3-3.el6_2.5
php-snmp-0:5.3.3-3.el6_2.5
php-soap-0:5.3.3-3.el6_2.5
php-tidy-0:5.3.3-3.el6_2.5
php-xml-0:5.3.3-3.el6_2.5
php-xmlrpc-0:5.3.3-3.el6_2.5
php-zts-0:5.3.3-3.el6_2.5
php53-0:5.3.3-1.el5_7.5
php53-bcmath-0:5.3.3-1.el5_7.5
php53-cli-0:5.3.3-1.el5_7.5
php53-common-0:5.3.3-1.el5_7.5
php53-dba-0:5.3.3-1.el5_7.5
php53-debuginfo-0:5.3.3-1.el5_7.5
php53-devel-0:5.3.3-1.el5_7.5
php53-gd-0:5.3.3-1.el5_7.5
php53-imap-0:5.3.3-1.el5_7.5
php53-intl-0:5.3.3-1.el5_7.5
php53-ldap-0:5.3.3-1.el5_7.5
php53-mbstring-0:5.3.3-1.el5_7.5
php53-mysql-0:5.3.3-1.el5_7.5
php53-odbc-0:5.3.3-1.el5_7.5
php53-pdo-0:5.3.3-1.el5_7.5
php53-pgsql-0:5.3.3-1.el5_7.5
php53-process-0:5.3.3-1.el5_7.5
php53-pspell-0:5.3.3-1.el5_7.5
php53-snmp-0:5.3.3-1.el5_7.5
php53-soap-0:5.3.3-1.el5_7.5
php53-xml-0:5.3.3-1.el5_7.5
php53-xmlrpc-0:5.3.3-1.el5_7.5
php-0:5.1.6-27.el5_7.4
php-bcmath-0:5.1.6-27.el5_7.4
php-cli-0:5.1.6-27.el5_7.4
php-common-0:5.1.6-27.el5_7.4
php-dba-0:5.1.6-27.el5_7.4
php-debuginfo-0:5.1.6-27.el5_7.4
php-devel-0:5.1.6-27.el5_7.4
php-gd-0:5.1.6-27.el5_7.4
php-imap-0:5.1.6-27.el5_7.4
php-ldap-0:5.1.6-27.el5_7.4
php-mbstring-0:5.1.6-27.el5_7.4
php-mysql-0:5.1.6-27.el5_7.4
php-ncurses-0:5.1.6-27.el5_7.4
php-odbc-0:5.1.6-27.el5_7.4
php-pdo-0:5.1.6-27.el5_7.4
php-pgsql-0:5.1.6-27.el5_7.4
php-snmp-0:5.1.6-27.el5_7.4
php-soap-0:5.1.6-27.el5_7.4
php-xml-0:5.1.6-27.el5_7.4
php-xmlrpc-0:5.1.6-27.el5_7.4
php-0:4.3.9-3.35
php-debuginfo-0:4.3.9-3.35
php-devel-0:4.3.9-3.35
php-domxml-0:4.3.9-3.35
php-gd-0:4.3.9-3.35
php-imap-0:4.3.9-3.35
php-ldap-0:4.3.9-3.35
php-mbstring-0:4.3.9-3.35
php-mysql-0:4.3.9-3.35
php-ncurses-0:4.3.9-3.35
php-odbc-0:4.3.9-3.35
php-pear-0:4.3.9-3.35
php-pgsql-0:4.3.9-3.35
php-snmp-0:4.3.9-3.35
php-xmlrpc-0:4.3.9-3.35

Seebug

bulletinFamily	exploit
description	No description provided by source.
id	SSV:72458
last seen	2017-11-19
modified	2014-07-01
published	2014-07-01
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-72458
title	PHP Hash Table Collision Proof Of Concept

bulletinFamily	exploit
description	CVE-2012-0830 Php是一款流行的编程语言 PHP在12月为哈希碰撞拒绝服务(CVE-2011-4885)(http://sebug.net/vuldb/ssvid-30001)提供的补丁引出了另一个严重的安全漏洞。防止哈希碰撞的补丁在php.ini中引入了新的配置属性： max_input_vars 此配置元素限制用于请求中使用的变量数量(如http://request.com/foo.php?a=1&b=2&c=3)，默认设置为1000。漏洞修补在php_variables.c代码中的php_register_variable_ex函数中作了更改，不过当变量数超过max_input_vars，而变量又是数组变量时(if (*p == ‘['))可触发此漏洞。漏洞可导致任意代码执行。 0 PHP PHP 5.3.9 PHP PHP 5.3.8 PHP PHP 5.3.7 PHP PHP 5.3.6 PHP PHP 5.3.5 厂商解决方案用户可参考如下供应商提供的安全补丁修复此漏洞： http://svn.php.net/viewvc/php/php-src/trunk/main/php_variables.c?view=markup&pathrev=323007
id	SSV:30071
last seen	2017-11-19
modified	2012-02-03
published	2012-02-03
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-30071
title	PHP "php_register_variable_ex()"函数任意代码执行漏洞(CVE-2012-0830)

bulletinFamily	exploit
description	No description provided by source.
id	SSV:26121
last seen	2017-11-19
modified	2011-12-29
published	2011-12-29
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-26121
title	Multiple Programming Language Implementations Vulnerable to Hash Table Collision Attacks

bulletinFamily	exploit
description	No description provided by source.
id	SSV:72454
last seen	2017-11-19
modified	2014-07-01
published	2014-07-01
reporter	Root
source	https://www.seebug.org/vuldb/ssvid-72454
title	PHP Hashtables Denial of Service

bulletinFamily	exploit
description	BUGTRAQ ID: 51193 CVE ID: CVE-2011-4885 PHP 5.3.9之前版本在计算表单参数哈希值的实现上没有提前限制哈希冲突，存在拒绝服务漏洞，通过发送小量的特制webform表单张贴到受影响应用程序，攻击者可利用此漏洞导致使用PHP的站点失去响应正常请求的能力 0 PHP 5.x 厂商补丁： PHP --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.php.net
id	SSV:30001
last seen	2017-11-19
modified	2012-01-01
published	2012-01-01
reporter	Root
title	PHP Web表单哈希冲突拒绝服务漏洞

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Exploit-Db

Metasploit

Nessus

Packetstorm

Redhat

Seebug

References