Vulnerabilities > CVE-2012-2386 - Numeric Errors vulnerability in PHP

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
php
CWE-189
nessus
exploit available

Summary

Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Vulnerable Configurations

Part Description Count
Application
Php
462

Common Weakness Enumeration (CWE)

Exploit-Db

descriptionPHP phar extension 1.1.1 - Heap Overflow. CVE-2012-2386. Dos exploits for multiple platform
idEDB-ID:17201
last seen2016-02-02
modified2011-04-22
published2011-04-22
reporterAlexander Gavrun
sourcehttps://www.exploit-db.com/download/17201/
titlePHP phar extension 1.1.1 - Heap Overflow

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120627_PHP_ON_SL6_X.NASL
    descriptionPHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-03-18
    modified2012-08-01
    plugin id61358
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61358
    titleScientific Linux Security Update : php on SL6.x i386/x86_64 (20120627)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61358);
      script_version("1.11");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/27");
    
      script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0781", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386");
      script_xref(name:"TRA", value:"TRA-2012-01");
    
      script_name(english:"Scientific Linux Security Update : php on SL6.x i386/x86_64 (20120627)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "PHP is an HTML-embedded scripting language commonly used with the
    Apache HTTP Server.
    
    It was discovered that the PHP XSL extension did not restrict the file
    writing capability of libxslt. A remote attacker could use this flaw
    to create or overwrite an arbitrary file that is writable by the user
    running PHP, if a PHP script processed untrusted eXtensible Style
    Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
    
    Note: This update disables file writing by default. A new PHP
    configuration directive, 'xsl.security_prefs', can be used to enable
    file writing in XSLT.
    
    A flaw was found in the way PHP validated file names in file upload
    requests. A remote attacker could possibly use this flaw to bypass the
    sanitization of the uploaded file names, and cause a PHP script to
    store the uploaded file in an unexpected directory, by using a
    directory traversal attack. (CVE-2012-1172)
    
    Multiple integer overflow flaws, leading to heap-based buffer
    overflows, were found in the way the PHP phar extension processed
    certain fields of tar archive files. A remote attacker could provide a
    specially crafted tar archive file that, when processed by a PHP
    application using the phar extension, could cause the application to
    crash or, potentially, execute arbitrary code with the privileges of
    the user running PHP. (CVE-2012-2386)
    
    A format string flaw was found in the way the PHP phar extension
    processed certain PHAR files. A remote attacker could provide a
    specially crafted PHAR file, which once processed in a PHP application
    using the phar extension, could lead to information disclosure and
    possibly arbitrary code execution via a crafted phar:// URI.
    (CVE-2010-2950)
    
    A flaw was found in the DES algorithm implementation in the crypt()
    password hashing function in PHP. If the password string to be hashed
    contained certain characters, the remainder of the string was ignored
    when calculating the hash, significantly reducing the password
    strength. (CVE-2012-2143)
    
    Note: With this update, passwords are no longer truncated when
    performing DES hashing. Therefore, new hashes of the affected
    passwords will not match stored hashes generated using vulnerable PHP
    versions, and will need to be updated.
    
    It was discovered that the fix for CVE-2012-1823, released via a
    previous update, did not properly filter all php-cgi command line
    arguments. A specially crafted request to a PHP script could cause the
    PHP interpreter to execute the script in a loop, or output usage
    information that triggers an Internal Server Error. (CVE-2012-2336)
    
    A memory leak flaw was found in the PHP strtotime() function call. A
    remote attacker could possibly use this flaw to cause excessive memory
    consumption by triggering many strtotime() function calls.
    (CVE-2012-0789)
    
    A NULL pointer dereference flaw was found in the PHP tidy_diagnose()
    function. A remote attacker could use specially crafted input to crash
    an application that uses tidy::diagnose. (CVE-2012-0781)
    
    It was found that PHP did not check the zend_strndup() function's
    return value in certain cases. A remote attacker could possibly use
    this flaw to crash a PHP application. (CVE-2011-4153)
    
    All php users should upgrade to these updated packages, which contain
    backported patches to resolve these issues. After installing the
    updated packages, the httpd daemon must be restarted for the update to
    take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=2427
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?055113e5"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2012-01"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-embedded");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-enchant");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php-zts");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 6.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL6", reference:"php-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-bcmath-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-cli-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-common-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-dba-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-debuginfo-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-devel-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-embedded-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-enchant-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-gd-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-imap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-intl-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-ldap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-mbstring-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-mysql-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-odbc-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-pdo-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-pgsql-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-process-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-pspell-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-recode-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-snmp-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-soap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-tidy-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-xml-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-xmlrpc-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"SL6", reference:"php-zts-5.3.3-14.el6_3")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc");
    }
    
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1047.NASL
    descriptionUpdated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id59753
    published2012-06-28
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59753
    titleRHEL 5 : php53 (RHSA-2012:1047)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:1047. The text 
    # itself is copyright (C) Red Hat, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59753);
      script_version ("1.24");
      script_cvs_date("Date: 2019/10/24 15:35:35");
    
      script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386");
      script_bugtraq_id(40173, 47545, 53729);
      script_xref(name:"RHSA", value:"2012:1047");
      script_xref(name:"TRA", value:"TRA-2012-01");
    
      script_name(english:"RHEL 5 : php53 (RHSA-2012:1047)");
      script_summary(english:"Checks the rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Red Hat host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated php53 packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 5.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PHP is an HTML-embedded scripting language commonly used with the
    Apache HTTP Server.
    
    It was discovered that the PHP XSL extension did not restrict the file
    writing capability of libxslt. A remote attacker could use this flaw
    to create or overwrite an arbitrary file that is writable by the user
    running PHP, if a PHP script processed untrusted eXtensible Style
    Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
    
    Note: This update disables file writing by default. A new PHP
    configuration directive, 'xsl.security_prefs', can be used to enable
    file writing in XSLT.
    
    A flaw was found in the way PHP validated file names in file upload
    requests. A remote attacker could possibly use this flaw to bypass the
    sanitization of the uploaded file names, and cause a PHP script to
    store the uploaded file in an unexpected directory, by using a
    directory traversal attack. (CVE-2012-1172)
    
    Multiple integer overflow flaws, leading to heap-based buffer
    overflows, were found in the way the PHP phar extension processed
    certain fields of tar archive files. A remote attacker could provide a
    specially crafted tar archive file that, when processed by a PHP
    application using the phar extension, could cause the application to
    crash or, potentially, execute arbitrary code with the privileges of
    the user running PHP. (CVE-2012-2386)
    
    A format string flaw was found in the way the PHP phar extension
    processed certain PHAR files. A remote attacker could provide a
    specially crafted PHAR file, which once processed in a PHP application
    using the phar extension, could lead to information disclosure and
    possibly arbitrary code execution via a crafted phar:// URI.
    (CVE-2010-2950)
    
    A flaw was found in the DES algorithm implementation in the crypt()
    password hashing function in PHP. If the password string to be hashed
    contained certain characters, the remainder of the string was ignored
    when calculating the hash, significantly reducing the password
    strength. (CVE-2012-2143)
    
    Note: With this update, passwords are no longer truncated when
    performing DES hashing. Therefore, new hashes of the affected
    passwords will not match stored hashes generated using vulnerable PHP
    versions, and will need to be updated.
    
    It was discovered that the fix for CVE-2012-1823, released via
    RHSA-2012:0547, did not properly filter all php-cgi command line
    arguments. A specially crafted request to a PHP script could cause the
    PHP interpreter to execute the script in a loop, or output usage
    information that triggers an Internal Server Error. (CVE-2012-2336)
    
    A memory leak flaw was found in the PHP strtotime() function call. A
    remote attacker could possibly use this flaw to cause excessive memory
    consumption by triggering many strtotime() function calls.
    (CVE-2012-0789)
    
    It was found that PHP did not check the zend_strndup() function's
    return value in certain cases. A remote attacker could possibly use
    this flaw to crash a PHP application. (CVE-2011-4153)
    
    Upstream acknowledges Rubin Xu and Joseph Bonneau as the original
    reporters of CVE-2012-2143.
    
    All php53 users should upgrade to these updated packages, which
    contain backported patches to resolve these issues. After installing
    the updated packages, the httpd daemon must be restarted for the
    update to take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://rhn.redhat.com/errata/RHSA-2012-0547.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/errata/RHSA-2012:1047"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-2143"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-2336"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0057"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-0789"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2011-4153"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-1172"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2012-2386"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://access.redhat.com/security/cve/cve-2010-2950"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2012-01"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:php53-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:5");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/06/28");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Red Hat Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
    os_ver = eregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 5.x", "Red Hat " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);
    
    yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
    if (!empty_or_null(yum_updateinfo)) 
    {
      rhsa = "RHSA-2012:1047";
      yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
      if (!empty_or_null(yum_report))
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : yum_report 
        );
        exit(0);
      }
      else
      {
        audit_message = "affected by Red Hat security advisory " + rhsa;
        audit(AUDIT_OS_NOT, audit_message);
      }
    }
    else
    {
      flag = 0;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-cli-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-cli-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-cli-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-common-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-common-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-common-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-dba-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-dba-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-dba-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-devel-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-devel-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-devel-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-gd-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-gd-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-gd-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-imap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-imap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-imap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-intl-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-intl-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-intl-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-ldap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-ldap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-ldap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-mysql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-mysql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-mysql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-odbc-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-odbc-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-odbc-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pdo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pdo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pdo-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-process-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-process-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-process-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-pspell-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-pspell-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-pspell-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-snmp-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-snmp-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-snmp-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-soap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-soap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-soap-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xml-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xml-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xml-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"i386", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"s390x", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++;
      if (rpm_check(release:"RHEL5", cpu:"x86_64", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++;
    
      if (flag)
      {
        security_report_v4(
          port       : 0,
          severity   : SECURITY_HOLE,
          extra      : rpm_report_get() + redhat_report_package_caveat()
        );
        exit(0);
      }
      else
      {
        tested = pkg_tests_get();
        if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
        else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php53 / php53-bcmath / php53-cli / php53-common / php53-dba / etc");
      }
    }
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20120627_PHP53_ON_SL5_X.NASL
    descriptionPHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-03-18
    modified2012-08-01
    plugin id61356
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/61356
    titleScientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61356);
      script_version("1.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386");
      script_xref(name:"TRA", value:"TRA-2012-01");
    
      script_name(english:"Scientific Linux Security Update : php53 on SL5.x i386/x86_64 (20120627)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "PHP is an HTML-embedded scripting language commonly used with the
    Apache HTTP Server.
    
    It was discovered that the PHP XSL extension did not restrict the file
    writing capability of libxslt. A remote attacker could use this flaw
    to create or overwrite an arbitrary file that is writable by the user
    running PHP, if a PHP script processed untrusted eXtensible Style
    Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
    
    Note: This update disables file writing by default. A new PHP
    configuration directive, 'xsl.security_prefs', can be used to enable
    file writing in XSLT.
    
    A flaw was found in the way PHP validated file names in file upload
    requests. A remote attacker could possibly use this flaw to bypass the
    sanitization of the uploaded file names, and cause a PHP script to
    store the uploaded file in an unexpected directory, by using a
    directory traversal attack. (CVE-2012-1172)
    
    Multiple integer overflow flaws, leading to heap-based buffer
    overflows, were found in the way the PHP phar extension processed
    certain fields of tar archive files. A remote attacker could provide a
    specially crafted tar archive file that, when processed by a PHP
    application using the phar extension, could cause the application to
    crash or, potentially, execute arbitrary code with the privileges of
    the user running PHP. (CVE-2012-2386)
    
    A format string flaw was found in the way the PHP phar extension
    processed certain PHAR files. A remote attacker could provide a
    specially crafted PHAR file, which once processed in a PHP application
    using the phar extension, could lead to information disclosure and
    possibly arbitrary code execution via a crafted phar:// URI.
    (CVE-2010-2950)
    
    A flaw was found in the DES algorithm implementation in the crypt()
    password hashing function in PHP. If the password string to be hashed
    contained certain characters, the remainder of the string was ignored
    when calculating the hash, significantly reducing the password
    strength. (CVE-2012-2143)
    
    Note: With this update, passwords are no longer truncated when
    performing DES hashing. Therefore, new hashes of the affected
    passwords will not match stored hashes generated using vulnerable PHP
    versions, and will need to be updated.
    
    It was discovered that the fix for CVE-2012-1823, released via a
    previous update, did not properly filter all php-cgi command line
    arguments. A specially crafted request to a PHP script could cause the
    PHP interpreter to execute the script in a loop, or output usage
    information that triggers an Internal Server Error. (CVE-2012-2336)
    
    A memory leak flaw was found in the PHP strtotime() function call. A
    remote attacker could possibly use this flaw to cause excessive memory
    consumption by triggering many strtotime() function calls.
    (CVE-2012-0789)
    
    It was found that PHP did not check the zend_strndup() function's
    return value in certain cases. A remote attacker could possibly use
    this flaw to crash a PHP application. (CVE-2011-4153)
    
    All php53 users should upgrade to these updated packages, which
    contain backported patches to resolve these issues. After installing
    the updated packages, the httpd daemon must be restarted for the
    update to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=594
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?84d5fe48"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2012-01"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:php53-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 5.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL5", reference:"php53-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-cli-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-common-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-dba-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-debuginfo-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-devel-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-gd-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-imap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-intl-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-ldap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-mysql-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-odbc-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-pdo-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-process-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-pspell-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-snmp-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-soap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-xml-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"SL5", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php53 / php53-bcmath / php53-cli / php53-common / php53-dba / etc");
    }
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-9762.NASL
    descriptionThe PHP development team would like to announce the immediate availability of PHP 5.3.14. All users of PHP are encouraged to upgrade to PHP 5.3.14. The release fixes multiple security issues: A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension. PHP 5.3.14 fixes over 30 bugs. Please note that the use of php://fd streams is now restricted to the CLI SAPI Changelog: http://www.php.net/ChangeLog-5.php#5.3.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-07-03
    plugin id59827
    published2012-07-03
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59827
    titleFedora 16 : maniadrive-1.2-32.fc16.6 / php-5.3.14-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.6 (2012-9762)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2012-9762.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(59827);
      script_version("1.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2386");
      script_bugtraq_id(47545, 53729);
      script_xref(name:"FEDORA", value:"2012-9762");
    
      script_name(english:"Fedora 16 : maniadrive-1.2-32.fc16.6 / php-5.3.14-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.6 (2012-9762)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The PHP development team would like to announce the immediate
    availability of PHP 5.3.14. All users of PHP are encouraged to upgrade
    to PHP 5.3.14.
    
    The release fixes multiple security issues: A weakness in the DES
    implementation of crypt and a heap overflow issue in the phar
    extension.
    
    PHP 5.3.14 fixes over 30 bugs. Please note that the use of php://fd
    streams is now restricted to the CLI SAPI
    
    Changelog: http://www.php.net/ChangeLog-5.php#5.3.14
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.php.net/ChangeLog-5.php#5.3.14"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=816956"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=823594"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2012-July/083374.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?3ee1a615"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2012-July/083375.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?0934de6c"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2012-July/083376.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?2a1472c3"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Update the affected maniadrive, php and / or php-eaccelerator
    packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:ND");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:maniadrive");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:php-eaccelerator");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:16");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/07/03");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2020 Tenable Network Security, Inc.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^16([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 16.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC16", reference:"maniadrive-1.2-32.fc16.6")) flag++;
    if (rpm_check(release:"FC16", reference:"php-5.3.14-1.fc16")) flag++;
    if (rpm_check(release:"FC16", reference:"php-eaccelerator-0.9.6.1-9.fc16.6")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "maniadrive / php / php-eaccelerator");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_APACHE2-MOD_PHP53-120618.NASL
    descriptionPHP5 was updated with incremental fixes to the previous update. - Additional unsafe cgi wrapper scripts are also fixed now. (CVE-2012-2335) - Even more commandline option handling is filtered, which could lead to crashes of the php interpreter. (CVE-2012-2336) - heap-based buffer overflow in php
    last seen2020-06-05
    modified2013-01-25
    plugin id64104
    published2013-01-25
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64104
    titleSuSE 11.2 Security Update : PHP5 (SAT Patch Number 6440)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from SuSE 11 update information. The text itself is
    # copyright (C) Novell, Inc.
    #
    
    if (NASL_LEVEL < 3000) exit(0);
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64104);
      script_version("1.3");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");
    
      script_cve_id("CVE-2012-2143", "CVE-2012-2335", "CVE-2012-2336", "CVE-2012-2386");
    
      script_name(english:"SuSE 11.2 Security Update : PHP5 (SAT Patch Number 6440)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SuSE 11 host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "PHP5 was updated with incremental fixes to the previous update.
    
      - Additional unsafe cgi wrapper scripts are also fixed
        now. (CVE-2012-2335)
    
      - Even more commandline option handling is filtered, which
        could lead to crashes of the php interpreter.
        (CVE-2012-2336)
    
      - heap-based buffer overflow in php's phar extension.
        (CVE-2012-2386)
    
      - The crypt() implementation ignored wide characters,
        leading to shorter effective password lengths. Note:
        With this update applied affected passwords will no
        longer work and need to be set again. (CVE-2012-2143)"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=761631"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=763814"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.novell.com/show_bug.cgi?id=766798"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2143.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2335.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2336.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://support.novell.com/security/cve/CVE-2012-2386.html"
      );
      script_set_attribute(attribute:"solution", value:"Apply SAT patch number 6440.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:apache2-mod_php53");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-bz2");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-calendar");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-ctype");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-curl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-dom");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-exif");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-fastcgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-fileinfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-ftp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-gettext");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-gmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-iconv");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-json");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-mcrypt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-openssl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-pcntl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-pear");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-shmop");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-suhosin");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-sysvmsg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-sysvsem");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-sysvshm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-tokenizer");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-wddx");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-xmlreader");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-xmlwriter");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-xsl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-zip");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:11:php53-zlib");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/25");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 Tenable Network Security, Inc.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)11") audit(AUDIT_OS_NOT, "SuSE 11");
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SuSE 11", cpu);
    
    pl = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(pl) || int(pl) != 2) audit(AUDIT_OS_NOT, "SuSE 11.2");
    
    
    flag = 0;
    if (rpm_check(release:"SLES11", sp:2, reference:"apache2-mod_php53-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-bcmath-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-bz2-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-calendar-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-ctype-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-curl-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-dba-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-dom-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-exif-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-fastcgi-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-fileinfo-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-ftp-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-gd-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-gettext-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-gmp-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-iconv-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-intl-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-json-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-ldap-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-mbstring-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-mcrypt-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-mysql-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-odbc-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-openssl-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-pcntl-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-pdo-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-pear-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-pgsql-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-pspell-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-shmop-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-snmp-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-soap-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-suhosin-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-sysvmsg-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-sysvsem-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-sysvshm-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-tokenizer-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-wddx-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-xmlreader-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-xmlrpc-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-xmlwriter-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-xsl-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-zip-5.3.8-0.33.2")) flag++;
    if (rpm_check(release:"SLES11", sp:2, reference:"php53-zlib-5.3.8-0.33.2")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1046.NASL
    descriptionFrom Red Hat Security Advisory 2012:1046 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id68570
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68570
    titleOracle Linux 6 : php (ELSA-2012-1046)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2012:1046 and 
    # Oracle Linux Security Advisory ELSA-2012-1046 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(68570);
      script_version("1.14");
      script_cvs_date("Date: 2019/09/30 10:58:17");
    
      script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0781", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386");
      script_bugtraq_id(40173, 46365, 46967, 46969, 46970, 46975, 46977, 47545, 47950, 48259, 49241, 51193, 51417, 51806, 51992, 52043, 53388, 53403, 53729);
      script_xref(name:"RHSA", value:"2012:1046");
      script_xref(name:"TRA", value:"TRA-2012-01");
    
      script_name(english:"Oracle Linux 6 : php (ELSA-2012-1046)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "From Red Hat Security Advisory 2012:1046 :
    
    Updated php packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 6.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PHP is an HTML-embedded scripting language commonly used with the
    Apache HTTP Server.
    
    It was discovered that the PHP XSL extension did not restrict the file
    writing capability of libxslt. A remote attacker could use this flaw
    to create or overwrite an arbitrary file that is writable by the user
    running PHP, if a PHP script processed untrusted eXtensible Style
    Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
    
    Note: This update disables file writing by default. A new PHP
    configuration directive, 'xsl.security_prefs', can be used to enable
    file writing in XSLT.
    
    A flaw was found in the way PHP validated file names in file upload
    requests. A remote attacker could possibly use this flaw to bypass the
    sanitization of the uploaded file names, and cause a PHP script to
    store the uploaded file in an unexpected directory, by using a
    directory traversal attack. (CVE-2012-1172)
    
    Multiple integer overflow flaws, leading to heap-based buffer
    overflows, were found in the way the PHP phar extension processed
    certain fields of tar archive files. A remote attacker could provide a
    specially crafted tar archive file that, when processed by a PHP
    application using the phar extension, could cause the application to
    crash or, potentially, execute arbitrary code with the privileges of
    the user running PHP. (CVE-2012-2386)
    
    A format string flaw was found in the way the PHP phar extension
    processed certain PHAR files. A remote attacker could provide a
    specially crafted PHAR file, which once processed in a PHP application
    using the phar extension, could lead to information disclosure and
    possibly arbitrary code execution via a crafted phar:// URI.
    (CVE-2010-2950)
    
    A flaw was found in the DES algorithm implementation in the crypt()
    password hashing function in PHP. If the password string to be hashed
    contained certain characters, the remainder of the string was ignored
    when calculating the hash, significantly reducing the password
    strength. (CVE-2012-2143)
    
    Note: With this update, passwords are no longer truncated when
    performing DES hashing. Therefore, new hashes of the affected
    passwords will not match stored hashes generated using vulnerable PHP
    versions, and will need to be updated.
    
    It was discovered that the fix for CVE-2012-1823, released via
    RHSA-2012:0546, did not properly filter all php-cgi command line
    arguments. A specially crafted request to a PHP script could cause the
    PHP interpreter to execute the script in a loop, or output usage
    information that triggers an Internal Server Error. (CVE-2012-2336)
    
    A memory leak flaw was found in the PHP strtotime() function call. A
    remote attacker could possibly use this flaw to cause excessive memory
    consumption by triggering many strtotime() function calls.
    (CVE-2012-0789)
    
    A NULL pointer dereference flaw was found in the PHP tidy_diagnose()
    function. A remote attacker could use specially crafted input to crash
    an application that uses tidy::diagnose. (CVE-2012-0781)
    
    It was found that PHP did not check the zend_strndup() function's
    return value in certain cases. A remote attacker could possibly use
    this flaw to crash a PHP application. (CVE-2011-4153)
    
    Upstream acknowledges Rubin Xu and Joseph Bonneau as the original
    reporters of CVE-2012-2143.
    
    All php users should upgrade to these updated packages, which contain
    backported patches to resolve these issues. After installing the
    updated packages, the httpd daemon must be restarted for the update to
    take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2012-June/002894.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2012-01"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected php packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-embedded");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-enchant");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:php-zts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/12");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^6([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL6", reference:"php-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-bcmath-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-cli-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-common-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-dba-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-devel-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-embedded-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-enchant-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-gd-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-imap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-intl-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-ldap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-mbstring-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-mysql-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-odbc-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-pdo-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-pgsql-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-process-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-pspell-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-recode-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-snmp-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-soap-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-tidy-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-xml-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-xmlrpc-5.3.3-14.el6_3")) flag++;
    if (rpm_check(release:"EL6", reference:"php-zts-5.3.3-14.el6_3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php / php-bcmath / php-cli / php-common / php-dba / php-devel / etc");
    }
    
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1047.NASL
    descriptionUpdated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id67089
    published2013-06-29
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67089
    titleCentOS 5 : php53 (CESA-2012:1047)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Red Hat Security Advisory RHSA-2012:1047 and 
    # CentOS Errata and Security Advisory 2012:1047 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(67089);
      script_version("1.12");
      script_cvs_date("Date: 2020/01/07");
    
      script_cve_id("CVE-2010-2950", "CVE-2011-4153", "CVE-2012-0057", "CVE-2012-0789", "CVE-2012-1172", "CVE-2012-2143", "CVE-2012-2336", "CVE-2012-2386");
      script_bugtraq_id(40173, 47545, 53729);
      script_xref(name:"RHSA", value:"2012:1047");
      script_xref(name:"TRA", value:"TRA-2012-01");
    
      script_name(english:"CentOS 5 : php53 (CESA-2012:1047)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote CentOS host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated php53 packages that fix multiple security issues are now
    available for Red Hat Enterprise Linux 5.
    
    The Red Hat Security Response Team has rated this update as having
    moderate security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    PHP is an HTML-embedded scripting language commonly used with the
    Apache HTTP Server.
    
    It was discovered that the PHP XSL extension did not restrict the file
    writing capability of libxslt. A remote attacker could use this flaw
    to create or overwrite an arbitrary file that is writable by the user
    running PHP, if a PHP script processed untrusted eXtensible Style
    Sheet Language Transformations (XSLT) content. (CVE-2012-0057)
    
    Note: This update disables file writing by default. A new PHP
    configuration directive, 'xsl.security_prefs', can be used to enable
    file writing in XSLT.
    
    A flaw was found in the way PHP validated file names in file upload
    requests. A remote attacker could possibly use this flaw to bypass the
    sanitization of the uploaded file names, and cause a PHP script to
    store the uploaded file in an unexpected directory, by using a
    directory traversal attack. (CVE-2012-1172)
    
    Multiple integer overflow flaws, leading to heap-based buffer
    overflows, were found in the way the PHP phar extension processed
    certain fields of tar archive files. A remote attacker could provide a
    specially crafted tar archive file that, when processed by a PHP
    application using the phar extension, could cause the application to
    crash or, potentially, execute arbitrary code with the privileges of
    the user running PHP. (CVE-2012-2386)
    
    A format string flaw was found in the way the PHP phar extension
    processed certain PHAR files. A remote attacker could provide a
    specially crafted PHAR file, which once processed in a PHP application
    using the phar extension, could lead to information disclosure and
    possibly arbitrary code execution via a crafted phar:// URI.
    (CVE-2010-2950)
    
    A flaw was found in the DES algorithm implementation in the crypt()
    password hashing function in PHP. If the password string to be hashed
    contained certain characters, the remainder of the string was ignored
    when calculating the hash, significantly reducing the password
    strength. (CVE-2012-2143)
    
    Note: With this update, passwords are no longer truncated when
    performing DES hashing. Therefore, new hashes of the affected
    passwords will not match stored hashes generated using vulnerable PHP
    versions, and will need to be updated.
    
    It was discovered that the fix for CVE-2012-1823, released via
    RHSA-2012:0547, did not properly filter all php-cgi command line
    arguments. A specially crafted request to a PHP script could cause the
    PHP interpreter to execute the script in a loop, or output usage
    information that triggers an Internal Server Error. (CVE-2012-2336)
    
    A memory leak flaw was found in the PHP strtotime() function call. A
    remote attacker could possibly use this flaw to cause excessive memory
    consumption by triggering many strtotime() function calls.
    (CVE-2012-0789)
    
    It was found that PHP did not check the zend_strndup() function's
    return value in certain cases. A remote attacker could possibly use
    this flaw to crash a PHP application. (CVE-2011-4153)
    
    Upstream acknowledges Rubin Xu and Joseph Bonneau as the original
    reporters of CVE-2012-2143.
    
    All php53 users should upgrade to these updated packages, which
    contain backported patches to resolve these issues. After installing
    the updated packages, the httpd daemon must be restarted for the
    update to take effect."
      );
      # https://lists.centos.org/pipermail/centos-announce/2012-June/018703.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?b8e42a3a"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.tenable.com/security/research/tra-2012-01"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected php53 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-2386");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-bcmath");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-dba");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-mbstring");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-pdo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-process");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-soap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-xml");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:php53-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2010/09/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/06/27");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/06/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"CentOS Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/CentOS/release");
    if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
    os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
    os_ver = os_ver[1];
    if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver);
    
    if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"CentOS-5", reference:"php53-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-bcmath-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-cli-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-common-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-dba-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-devel-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-gd-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-imap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-intl-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-ldap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-mbstring-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-mysql-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-odbc-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-pdo-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-pgsql-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-process-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-pspell-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-snmp-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-soap-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-xml-5.3.3-13.el5_8")) flag++;
    if (rpm_check(release:"CentOS-5", reference:"php53-xmlrpc-5.3.3-13.el5_8")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "php53 / php53-bcmath / php53-cli / php53-common / php53-dba / etc");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2492.NASL
    descriptionThe Phar extension for PHP does not properly handle crafted tar files, leading to a heap-based buffer overflow. PHP applications processing tar files could crash or, potentially, execute arbitrary code. In addition, this update addresses a regression which caused a crash when accessing a global object that is returned as $this from __get.
    last seen2020-03-17
    modified2012-06-29
    plugin id59770
    published2012-06-29
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59770
    titleDebian DSA-2492-1 : php5 - buffer overflow
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2012-95.NASL
    descriptionInteger overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow. The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
    last seen2020-06-01
    modified2020-06-02
    plugin id69702
    published2013-09-04
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/69702
    titleAmazon Linux AMI : php (ALAS-2012-95)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2012-9490.NASL
    descriptionThe PHP development team would like to announce the immediate availability of PHP 5.4.4. All users of PHP are encouraged to upgrade to PHP 5.4.4. The release fixes multiple security issues: A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension. PHP 5.4.4 fixes over 30 bugs. Please note that the use of php://fd streams is now restricted to the CLI SAPI Changelog: http://www.php.net/ChangeLog-5.php#5.4.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2012-07-01
    plugin id59801
    published2012-07-01
    reporterThis script is Copyright (C) 2012-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59801
    titleFedora 17 : maniadrive-1.2-41.fc17 / php-5.4.4-1.fc17 (2012-9490)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201209-03.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201209-03 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, create arbitrary files, conduct directory traversal attacks, bypass protection mechanisms, or perform further attacks with unspecified impact. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id62236
    published2012-09-24
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/62236
    titleGLSA-201209-03 : PHP: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2012-311.NASL
    descriptionSpecially crafted tar archives could cause an integer overflow in the phar extension
    last seen2020-06-05
    modified2014-06-13
    plugin id74645
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/74645
    titleopenSUSE Security Update : php5 (openSUSE-SU-2012:0695-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1481-1.NASL
    descriptionIt was discovered that PHP incorrectly handled certain Tidy::diagnose operations on invalid objects. A remote attacker could use this flaw to cause PHP to crash, leading to a denial of service. (CVE-2012-0781) It was discovered that PHP incorrectly handled certain multi-file upload filenames. A remote attacker could use this flaw to cause a denial of service, or to perform a directory traversal attack. (CVE-2012-1172) Rubin Xu and Joseph Bonneau discovered that PHP incorrectly handled certain Unicode characters in passwords passed to the crypt() function. A remote attacker could possibly use this flaw to bypass authentication. (CVE-2012-2143) It was discovered that a Debian/Ubuntu specific patch caused PHP to incorrectly handle empty salt strings. A remote attacker could possibly use this flaw to bypass authentication. This issue only affected Ubuntu 10.04 LTS and Ubuntu 11.04. (CVE-2012-2317) It was discovered that PHP, when used as a stand alone CGI processor for the Apache Web Server, did not properly parse and filter query strings. This could allow a remote attacker to execute arbitrary code running with the privilege of the web server, or to perform a denial of service. Configurations using mod_php5 and FastCGI were not vulnerable. (CVE-2012-2335, CVE-2012-2336) Alexander Gavrun discovered that the PHP Phar extension incorrectly handled certain malformed TAR files. A remote attacker could use this flaw to perform a denial of service, or possibly execute arbitrary code. (CVE-2012-2386). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id59603
    published2012-06-20
    reporterUbuntu Security Notice (C) 2012-2019 Canonical, Inc. / NASL script (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59603
    titleUbuntu 8.04 LTS / 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : php5 vulnerabilities (USN-1481-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2012-1046.NASL
    descriptionUpdated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id59752
    published2012-06-28
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59752
    titleRHEL 6 : php (RHSA-2012:1046)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2012-1047.NASL
    descriptionFrom Red Hat Security Advisory 2012:1047 : Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id68571
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68571
    titleOracle Linux 5 : php53 (ELSA-2012-1047)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_8_2.NASL
    descriptionThe remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.2. The newer version contains multiple security-related fixes for the following components : - BIND - Data Security - LoginWindow - Mobile Accounts - PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id62215
    published2012-09-20
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62215
    titleMac OS X 10.8.x < 10.8.2 Multiple Vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2012-1046.NASL
    descriptionUpdated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057) Note: This update disables file writing by default. A new PHP configuration directive,
    last seen2020-06-01
    modified2020-06-02
    plugin id59938
    published2012-07-11
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59938
    titleCentOS 6 : php (CESA-2012:1046)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2012-004.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-004 applied. This update contains multiple security-related fixes for the following components : - Apache - Data Security - DirectoryService - ImageIO - International Components for Unicode - Mail - PHP - QuickLook - QuickTime - Ruby
    last seen2020-06-01
    modified2020-06-02
    plugin id62213
    published2012-09-20
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62213
    titleMac OS X Multiple Vulnerabilities (Security Update 2012-004) (BEAST)
  • NASL familyCGI abuses
    NASL idPHP_5_3_14.NASL
    descriptionAccording to its banner, the version of PHP installed on the remote host is 5.3.x earlier than 5.3.14, and is, therefore, potentially affected the following vulnerabilities : - An integer overflow error exists in the function
    last seen2020-04-30
    modified2012-06-15
    plugin id59529
    published2012-06-15
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59529
    titlePHP 5.3.x < 5.3.14 Multiple Vulnerabilities
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2012-093.NASL
    descriptionMultiple vulnerabilities has been identified and fixed in php : There is a programming error in the DES implementation used in crypt() in ext/standard/crypt_freesec.c when handling input which contains characters that can not be represented with 7-bit ASCII. When the input contains characters with only the most significant bit set (0x80), that character and all characters after it will be ignored (CVE-2012-2143). An integer overflow, leading to heap-based buffer overflow was found in the way Phar extension of the PHP scripting language processed certain fields by manipulating TAR files. A remote attacker could provide a specially crafted TAR archive file, which once processed in an PHP application using the Phar extension could lead to denial of service (application crash), or, potentially arbitary code execution with the privileges of the user running the application (CVE-2012-2386). The updated php packages have been upgraded to the 5.3.14 version which is not vulnerable to these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id59519
    published2012-06-15
    reporterThis script is Copyright (C) 2012-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/59519
    titleMandriva Linux Security Advisory : php (MDVSA-2012:093)
  • NASL familyCGI abuses
    NASL idPHP_5_4_4.NASL
    descriptionAccording to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities : - An integer overflow error exists in the function
    last seen2020-06-01
    modified2020-06-02
    plugin id59530
    published2012-06-15
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59530
    titlePHP 5.4.x < 5.4.4 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_7_5.NASL
    descriptionThe remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components : - Apache - BIND - CoreText - Data Security - ImageIO - Installer - International Components for Unicode - Kernel - Mail - PHP - Profile Manager - QuickLook - QuickTime - Ruby - USB
    last seen2020-06-01
    modified2020-06-02
    plugin id62214
    published2012-09-20
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/62214
    titleMac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)

Redhat

advisories
  • bugzilla
    id835024
    titleCVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 6 is installed
        ovaloval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • commentphp-xmlrpc is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046001
          • commentphp-xmlrpc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195016
        • AND
          • commentphp-pgsql is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046003
          • commentphp-pgsql is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195022
        • AND
          • commentphp-ldap is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046005
          • commentphp-ldap is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195012
        • AND
          • commentphp-mysql is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046007
          • commentphp-mysql is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195006
        • AND
          • commentphp-cli is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046009
          • commentphp-cli is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195002
        • AND
          • commentphp-common is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046011
          • commentphp-common is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195014
        • AND
          • commentphp is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046013
          • commentphp is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195018
        • AND
          • commentphp-gd is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046015
          • commentphp-gd is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195008
        • AND
          • commentphp-odbc is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046017
          • commentphp-odbc is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195004
        • AND
          • commentphp-xml is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046019
          • commentphp-xml is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195020
        • AND
          • commentphp-soap is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046021
          • commentphp-soap is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195010
        • AND
          • commentphp-pdo is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046023
          • commentphp-pdo is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195024
        • AND
          • commentphp-recode is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046025
          • commentphp-recode is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195042
        • AND
          • commentphp-pspell is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046027
          • commentphp-pspell is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195026
        • AND
          • commentphp-tidy is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046029
          • commentphp-tidy is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195036
        • AND
          • commentphp-process is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046031
          • commentphp-process is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195028
        • AND
          • commentphp-snmp is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046033
          • commentphp-snmp is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195038
        • AND
          • commentphp-zts is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046035
          • commentphp-zts is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195032
        • AND
          • commentphp-bcmath is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046037
          • commentphp-bcmath is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195048
        • AND
          • commentphp-imap is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046039
          • commentphp-imap is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195040
        • AND
          • commentphp-dba is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046041
          • commentphp-dba is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195034
        • AND
          • commentphp-intl is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046043
          • commentphp-intl is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195050
        • AND
          • commentphp-mbstring is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046045
          • commentphp-mbstring is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195044
        • AND
          • commentphp-embedded is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046047
          • commentphp-embedded is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195046
        • AND
          • commentphp-devel is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046049
          • commentphp-devel is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195052
        • AND
          • commentphp-enchant is earlier than 0:5.3.3-14.el6_3
            ovaloval:com.redhat.rhsa:tst:20121046051
          • commentphp-enchant is signed with Red Hat redhatrelease2 key
            ovaloval:com.redhat.rhsa:tst:20110195030
    rhsa
    idRHSA-2012:1046
    released2012-06-27
    severityModerate
    titleRHSA-2012:1046: php security update (Moderate)
  • bugzilla
    id835024
    titleCVE-2010-2950 php: Format string flaw in phar extension via phar_stream_flush() (MOPS-2010-024)
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 5 is installed
        ovaloval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • commentphp53-mbstring is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047001
          • commentphp53-mbstring is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196040
        • AND
          • commentphp53-devel is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047003
          • commentphp53-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196004
        • AND
          • commentphp53-common is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047005
          • commentphp53-common is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196018
        • AND
          • commentphp53-gd is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047007
          • commentphp53-gd is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196030
        • AND
          • commentphp53-soap is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047009
          • commentphp53-soap is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196022
        • AND
          • commentphp53-pdo is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047011
          • commentphp53-pdo is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196036
        • AND
          • commentphp53-imap is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047013
          • commentphp53-imap is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196016
        • AND
          • commentphp53-mysql is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047015
          • commentphp53-mysql is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196008
        • AND
          • commentphp53-snmp is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047017
          • commentphp53-snmp is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196010
        • AND
          • commentphp53-dba is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047019
          • commentphp53-dba is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196002
        • AND
          • commentphp53 is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047021
          • commentphp53 is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196006
        • AND
          • commentphp53-bcmath is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047023
          • commentphp53-bcmath is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196026
        • AND
          • commentphp53-intl is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047025
          • commentphp53-intl is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196014
        • AND
          • commentphp53-odbc is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047027
          • commentphp53-odbc is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196042
        • AND
          • commentphp53-ldap is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047029
          • commentphp53-ldap is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196020
        • AND
          • commentphp53-pspell is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047031
          • commentphp53-pspell is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196038
        • AND
          • commentphp53-xmlrpc is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047033
          • commentphp53-xmlrpc is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196034
        • AND
          • commentphp53-xml is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047035
          • commentphp53-xml is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196028
        • AND
          • commentphp53-cli is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047037
          • commentphp53-cli is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196032
        • AND
          • commentphp53-process is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047039
          • commentphp53-process is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196012
        • AND
          • commentphp53-pgsql is earlier than 0:5.3.3-13.el5_8
            ovaloval:com.redhat.rhsa:tst:20121047041
          • commentphp53-pgsql is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20110196024
    rhsa
    idRHSA-2012:1047
    released2012-06-27
    severityModerate
    titleRHSA-2012:1047: php53 security update (Moderate)
rpms
  • php-0:5.3.3-14.el6_3
  • php-bcmath-0:5.3.3-14.el6_3
  • php-cli-0:5.3.3-14.el6_3
  • php-common-0:5.3.3-14.el6_3
  • php-dba-0:5.3.3-14.el6_3
  • php-debuginfo-0:5.3.3-14.el6_3
  • php-devel-0:5.3.3-14.el6_3
  • php-embedded-0:5.3.3-14.el6_3
  • php-enchant-0:5.3.3-14.el6_3
  • php-gd-0:5.3.3-14.el6_3
  • php-imap-0:5.3.3-14.el6_3
  • php-intl-0:5.3.3-14.el6_3
  • php-ldap-0:5.3.3-14.el6_3
  • php-mbstring-0:5.3.3-14.el6_3
  • php-mysql-0:5.3.3-14.el6_3
  • php-odbc-0:5.3.3-14.el6_3
  • php-pdo-0:5.3.3-14.el6_3
  • php-pgsql-0:5.3.3-14.el6_3
  • php-process-0:5.3.3-14.el6_3
  • php-pspell-0:5.3.3-14.el6_3
  • php-recode-0:5.3.3-14.el6_3
  • php-snmp-0:5.3.3-14.el6_3
  • php-soap-0:5.3.3-14.el6_3
  • php-tidy-0:5.3.3-14.el6_3
  • php-xml-0:5.3.3-14.el6_3
  • php-xmlrpc-0:5.3.3-14.el6_3
  • php-zts-0:5.3.3-14.el6_3
  • php53-0:5.3.3-13.el5_8
  • php53-bcmath-0:5.3.3-13.el5_8
  • php53-cli-0:5.3.3-13.el5_8
  • php53-common-0:5.3.3-13.el5_8
  • php53-dba-0:5.3.3-13.el5_8
  • php53-debuginfo-0:5.3.3-13.el5_8
  • php53-devel-0:5.3.3-13.el5_8
  • php53-gd-0:5.3.3-13.el5_8
  • php53-imap-0:5.3.3-13.el5_8
  • php53-intl-0:5.3.3-13.el5_8
  • php53-ldap-0:5.3.3-13.el5_8
  • php53-mbstring-0:5.3.3-13.el5_8
  • php53-mysql-0:5.3.3-13.el5_8
  • php53-odbc-0:5.3.3-13.el5_8
  • php53-pdo-0:5.3.3-13.el5_8
  • php53-pgsql-0:5.3.3-13.el5_8
  • php53-process-0:5.3.3-13.el5_8
  • php53-pspell-0:5.3.3-13.el5_8
  • php53-snmp-0:5.3.3-13.el5_8
  • php53-soap-0:5.3.3-13.el5_8
  • php53-xml-0:5.3.3-13.el5_8
  • php53-xmlrpc-0:5.3.3-13.el5_8