Vulnerabilities > CVE-2015-4021 - Numeric Errors vulnerability in multiple products

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
redhat
apple
php
CWE-189
nessus

Summary

The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.

Vulnerable Configurations

Part Description Count
OS
Redhat
8
OS
Apple
91
Application
Php
654

Common Weakness Enumeration (CWE)

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2015-396.NASL
    descriptionphp5 was updated to fix four security issues. The following vulnerabilities were fixed : - CVE-2015-4024: Multipart/form-data remote dos Vulnerability (bnc#931421) - CVE-2015-4026: pcntl_exec() does not check path validity (bnc#931776) - CVE-2015-4022: overflow in ftp_genlist() resulting in heap overflow (bnc#931772) - CVE-2015-4021: memory corruption in phar_parse_tarfile when entry filename starts with NULL (bnc#931769)
    last seen2020-06-05
    modified2015-06-04
    plugin id83983
    published2015-06-04
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83983
    titleopenSUSE Security Update : php5 (openSUSE-2015-396)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-8370.NASL
    description14 May 2015, **PHP 5.5.25** **Core:** - Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (Stas) - Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). (Stas) - Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (Stas) - Fixed bug #69522 (heap buffer overflow in unpack()). (Stas) - Fixed bug #69467 (Wrong checked for the interface by using Trait). (Laruence) - Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence) - Fixed bug #60022 (
    last seen2020-06-05
    modified2015-05-29
    plugin id83895
    published2015-05-29
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83895
    titleFedora 20 : php-5.5.25-1.fc20 (2015-8370)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2658-1.NASL
    descriptionNeal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598) Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service. (CVE-2015-4021) Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022, CVE-2015-4643) Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could use this issue with crafted form data to cause CPU consumption, leading to a denial of service. (CVE-2015-4024) Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147) Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive information. (CVE-2015-4148) Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote attacker could possibly use these issues to obtain sensitive information or cause a denial of service. (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603) It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605) It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84563
    published2015-07-07
    reporterUbuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84563
    titleUbuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : php5 vulnerabilities (USN-2658-1)
  • NASL familyCGI abuses
    NASL idPHP_5_4_41.NASL
    descriptionAccording to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.41. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws in pcrelib. (CVE-2015-2325, CVE-2015-2326) - A flaw in the phar_parse_tarfile function in ext/phar/tar.c could allow a denial of service via a crafted entry in a tar archive. (CVE-2015-4021) - An integer overflow condition exists in the ftp_genlist() function in ftp.c due to improper validation of user-supplied input. A remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or possible remote code execution. (CVE-2015-4022) - Multiple flaws exist related to using pathnames containing NULL bytes. A remote attacker can exploit these flaws, by combining the
    last seen2020-06-01
    modified2020-06-02
    plugin id83517
    published2015-05-18
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83517
    titlePHP 5.4.x < 5.4.41 Multiple Vulnerabilities
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201606-10.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id91704
    published2016-06-20
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91704
    titleGLSA-201606-10 : PHP: Multiple vulnerabilities
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1544.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id124997
    published2019-05-14
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124997
    titleEulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-1218.NASL
    descriptionFrom Red Hat Security Advisory 2015:1218 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84659
    published2015-07-13
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84659
    titleOracle Linux 6 : php (ELSA-2015-1218)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2015-1135.NASL
    descriptionFrom Red Hat Security Advisory 2015:1135 : Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84351
    published2015-06-24
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84351
    titleOracle Linux 7 : php (ELSA-2015-1135)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150709_PHP_ON_SL6_X.NASL
    descriptionA flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-03-18
    modified2015-07-13
    plugin id84661
    published2015-07-13
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84661
    titleScientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)
  • NASL familyCGI abuses
    NASL idPHP_5_6_9.NASL
    descriptionAccording to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.9. It is, therefore, affected by multiple vulnerabilities : - Multiple unspecified flaws in pcrelib. (CVE-2015-2325, CVE-2015-2326) - A flaw in the phar_parse_tarfile function in ext/phar/tar.c could allow a denial of service via a crafted entry in a tar archive. (CVE-2015-4021) - Multiple flaws exist related to using pathnames containing NULL bytes. A remote attacker can exploit these flaws, by combining the
    last seen2020-06-01
    modified2020-06-02
    plugin id83519
    published2015-05-18
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83519
    titlePHP 5.6.x < 5.6.9 Multiple Vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-1135.NASL
    descriptionUpdated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84355
    published2015-06-24
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84355
    titleRHEL 7 : php (RHSA-2015:1135)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-1135.NASL
    descriptionUpdated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84345
    published2015-06-24
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84345
    titleCentOS 7 : php (CESA-2015:1135)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1638-1.NASL
    descriptionThis update for php53 to version 5.3.17 fixes the following issues : These security issues were fixed : - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id93161
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93161
    titleSUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-534.NASL
    descriptionAn integer underflow flaw leading to out-of-bounds memory access was found in the way PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id83973
    published2015-06-04
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83973
    titleAmazon Linux AMI : php54 (ALAS-2015-534)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-1253-1.NASL
    descriptionThis security update of PHP fixes the following issues : Security issues fixed : - CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. - CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. - CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. - CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. - CVE-2015-4148 [bnc#933227]: Fixed SoapClient
    last seen2020-03-24
    modified2019-01-02
    plugin id119968
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119968
    titleSUSE SLES12 Security Update : php5 (SUSE-SU-2015:1253-1)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-536.NASL
    descriptionAn integer underflow flaw leading to out-of-bounds memory access was found in the way PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id83975
    published2015-06-04
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83975
    titleAmazon Linux AMI : php56 (ALAS-2015-536)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_10_5.NASL
    descriptionThe remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - Apple ID OD Plug-in - AppleGraphicsControl - Bluetooth - bootp - CloudKit - CoreMedia Playback - CoreText - curl - Data Detectors Engine - Date & Time pref pane - Dictionary Application - DiskImages - dyld - FontParser - groff - ImageIO - Install Framework Legacy - IOFireWireFamily - IOGraphics - IOHIDFamily - Kernel - Libc - Libinfo - libpthread - libxml2 - libxpc - mail_cmds - Notification Center OSX - ntfs - OpenSSH - OpenSSL - perl - PostgreSQL - python - QL Office - Quartz Composer Framework - Quick Look - QuickTime 7 - SceneKit - Security - SMBClient - Speech UI - sudo - tcpdump - Text Formats - udf Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id85408
    published2015-08-17
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/85408
    titleMac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2015-1218.NASL
    descriptionUpdated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84660
    published2015-07-13
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84660
    titleRHEL 6 : php (RHSA-2015:1218)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2015-006.NASL
    descriptionThe remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components : - apache - apache_mod_php - CoreText - FontParser - Libinfo - libxml2 - OpenSSL - perl - PostgreSQL - QL Office - Quartz Composer Framework - QuickTime 7 - SceneKit Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id85409
    published2015-08-17
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/85409
    titleMac OS X Multiple Vulnerabilities (Security Update 2015-006)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-8281.NASL
    description14 May 2015, **PHP 5.6.9** Core : - Fixed bug #69467 (Wrong checked for the interface by using Trait). (Laruence) - Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence) - Fixed bug #60022 (
    last seen2020-06-05
    modified2015-05-27
    plugin id83835
    published2015-05-27
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83835
    titleFedora 22 : php-5.6.9-1.fc22 (2015-8281)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_31DE2E1300D211E5A072D050996490D0.NASL
    descriptionPHP development team reports : Fixed bug #69364 (PHP Multipart/form-data remote DoS Vulnerability). (CVE-2015-4024) Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025) Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4022) Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026) Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry filename starts with null). (CVE-2015-4021)
    last seen2020-06-01
    modified2020-06-02
    plugin id83792
    published2015-05-26
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83792
    titleFreeBSD : php -- multiple vulnerabilities (31de2e13-00d2-11e5-a072-d050996490d0)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-307.NASL
    description - CVE-2015-3307 The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive. - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) - CVE-2015-4021 The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive. - CVE-2015-4022 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. - CVE-2015-4026 The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. - CVE-2015-4147 The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a
    last seen2020-03-17
    modified2015-09-08
    plugin id85808
    published2015-09-08
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/85808
    titleDebian DLA-307-1 : php5 security update
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20150623_PHP_ON_SL7_X.NASL
    descriptionA flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-03-18
    modified2015-06-25
    plugin id84394
    published2015-06-25
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84394
    titleScientific Linux Security Update : php on SL7.x x86_64 (20150623)
  • NASL familyMisc.
    NASL idSECURITYCENTER_PHP_5_4_41.NASL
    descriptionThe SecurityCenter application installed on the remote host is affected by multiple vulnerabilities in the bundled version of PHP that is prior to version 5.4.41. It is, therefore, affected by the following vulnerabilities : - A flaw in the phar_parse_tarfile function in ext/phar/tar.c could allow a denial of service via a crafted entry in a tar archive. (CVE-2015-4021) - An integer overflow condition exists in the ftp_genlist() function in ftp.c due to improper validation of user-supplied input. A remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or possible remote code execution. (CVE-2015-4022) - Multiple flaws exist related to using pathnames containing NULL bytes. A remote attacker can exploit these flaws, by combining the
    last seen2020-06-01
    modified2020-06-02
    plugin id85566
    published2015-08-20
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/85566
    titleTenable SecurityCenter Multiple PHP Vulnerabilities (TNS-2015-06)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2015-535.NASL
    descriptionAn integer underflow flaw leading to out-of-bounds memory access was found in the way PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id83974
    published2015-06-04
    reporterThis script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83974
    titleAmazon Linux AMI : php55 (ALAS-2015-535)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3280.NASL
    descriptionMultiple vulnerabilities have been discovered in PHP : - CVE-2015-4025 / CVE-2015-4026 Multiple function didn
    last seen2020-06-01
    modified2020-06-02
    plugin id84025
    published2015-06-09
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84025
    titleDebian DSA-3280-1 : php5 - security update
  • NASL familyCGI abuses
    NASL idPHP_5_5_25.NASL
    descriptionAccording to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.25. It is, therefore, affected by multiple vulnerabilities : - A flaw in the phar_parse_tarfile function in ext/phar/tar.c could allow a denial of service via a crafted entry in a tar archive. (CVE-2015-4021) - An integer overflow condition exists in the ftp_genlist() function in ftp.c due to improper validation of user-supplied input. A remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or possible remote code execution. (CVE-2015-4022) - Multiple flaws exist related to using pathnames containing NULL bytes. A remote attacker can exploit these flaws, by combining the
    last seen2020-06-01
    modified2020-06-02
    plugin id83518
    published2015-05-18
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/83518
    titlePHP 5.5.x < 5.5.25 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2015-1018-1.NASL
    descriptionPHP 5.3 was updated to fix multiple security issues : bnc#931776: pcntl_exec() does not check path validity (CVE-2015-4026) bnc#931772: overflow in ftp_genlist() resulting in heap overflow (CVE-2015-4022) bnc#931769: memory corruption in phar_parse_tarfile when entry filename starts with NULL (CVE-2015-4021) bnc#931421: multipart/form-data remote denial-of-service vulnerability (CVE-2015-4024) bnc#928511: buffer over-read in unserialize when parsing Phar (CVE-2015-2783) bnc#928506: buffer over flow when parsing tar/zip/phar in phar_set_inode() (CVE-2015-3329) bnc#925109: SoapClient
    last seen2020-06-01
    modified2020-06-02
    plugin id84082
    published2015-06-10
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84082
    titleSUSE SLES11 Security Update : php53 (SUSE-SU-2015:1018-1)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2015-8383.NASL
    description14 May 2015, **PHP 5.6.9** Core : - Fixed bug #69467 (Wrong checked for the interface by using Trait). (Laruence) - Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence) - Fixed bug #60022 (
    last seen2020-06-05
    modified2015-05-29
    plugin id83896
    published2015-05-29
    reporterThis script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/83896
    titleFedora 21 : php-5.6.9-1.fc21 (2015-8383)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2015-1218.NASL
    descriptionUpdated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
    last seen2020-06-01
    modified2020-06-02
    plugin id84648
    published2015-07-13
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84648
    titleCentOS 6 : php (CESA-2015:1218)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2015-162-02.NASL
    descriptionNew php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id84127
    published2015-06-12
    reporterThis script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/84127
    titleSlackware 14.0 / 14.1 / current : php (SSA:2015-162-02)

Redhat

advisories
  • rhsa
    idRHSA-2015:1135
  • rhsa
    idRHSA-2015:1186
  • rhsa
    idRHSA-2015:1187
  • rhsa
    idRHSA-2015:1218
  • rhsa
    idRHSA-2015:1219
rpms
  • php-0:5.4.16-36.ael7b_1
  • php-0:5.4.16-36.el7_1
  • php-bcmath-0:5.4.16-36.ael7b_1
  • php-bcmath-0:5.4.16-36.el7_1
  • php-cli-0:5.4.16-36.ael7b_1
  • php-cli-0:5.4.16-36.el7_1
  • php-common-0:5.4.16-36.ael7b_1
  • php-common-0:5.4.16-36.el7_1
  • php-dba-0:5.4.16-36.ael7b_1
  • php-dba-0:5.4.16-36.el7_1
  • php-debuginfo-0:5.4.16-36.ael7b_1
  • php-debuginfo-0:5.4.16-36.el7_1
  • php-devel-0:5.4.16-36.ael7b_1
  • php-devel-0:5.4.16-36.el7_1
  • php-embedded-0:5.4.16-36.ael7b_1
  • php-embedded-0:5.4.16-36.el7_1
  • php-enchant-0:5.4.16-36.ael7b_1
  • php-enchant-0:5.4.16-36.el7_1
  • php-fpm-0:5.4.16-36.ael7b_1
  • php-fpm-0:5.4.16-36.el7_1
  • php-gd-0:5.4.16-36.ael7b_1
  • php-gd-0:5.4.16-36.el7_1
  • php-intl-0:5.4.16-36.ael7b_1
  • php-intl-0:5.4.16-36.el7_1
  • php-ldap-0:5.4.16-36.ael7b_1
  • php-ldap-0:5.4.16-36.el7_1
  • php-mbstring-0:5.4.16-36.ael7b_1
  • php-mbstring-0:5.4.16-36.el7_1
  • php-mysql-0:5.4.16-36.ael7b_1
  • php-mysql-0:5.4.16-36.el7_1
  • php-mysqlnd-0:5.4.16-36.ael7b_1
  • php-mysqlnd-0:5.4.16-36.el7_1
  • php-odbc-0:5.4.16-36.ael7b_1
  • php-odbc-0:5.4.16-36.el7_1
  • php-pdo-0:5.4.16-36.ael7b_1
  • php-pdo-0:5.4.16-36.el7_1
  • php-pgsql-0:5.4.16-36.ael7b_1
  • php-pgsql-0:5.4.16-36.el7_1
  • php-process-0:5.4.16-36.ael7b_1
  • php-process-0:5.4.16-36.el7_1
  • php-pspell-0:5.4.16-36.ael7b_1
  • php-pspell-0:5.4.16-36.el7_1
  • php-recode-0:5.4.16-36.ael7b_1
  • php-recode-0:5.4.16-36.el7_1
  • php-snmp-0:5.4.16-36.ael7b_1
  • php-snmp-0:5.4.16-36.el7_1
  • php-soap-0:5.4.16-36.ael7b_1
  • php-soap-0:5.4.16-36.el7_1
  • php-xml-0:5.4.16-36.ael7b_1
  • php-xml-0:5.4.16-36.el7_1
  • php-xmlrpc-0:5.4.16-36.ael7b_1
  • php-xmlrpc-0:5.4.16-36.el7_1
  • php55-php-0:5.5.21-4.el6
  • php55-php-0:5.5.21-4.el7
  • php55-php-bcmath-0:5.5.21-4.el6
  • php55-php-bcmath-0:5.5.21-4.el7
  • php55-php-cli-0:5.5.21-4.el6
  • php55-php-cli-0:5.5.21-4.el7
  • php55-php-common-0:5.5.21-4.el6
  • php55-php-common-0:5.5.21-4.el7
  • php55-php-dba-0:5.5.21-4.el6
  • php55-php-dba-0:5.5.21-4.el7
  • php55-php-debuginfo-0:5.5.21-4.el6
  • php55-php-debuginfo-0:5.5.21-4.el7
  • php55-php-devel-0:5.5.21-4.el6
  • php55-php-devel-0:5.5.21-4.el7
  • php55-php-enchant-0:5.5.21-4.el6
  • php55-php-enchant-0:5.5.21-4.el7
  • php55-php-fpm-0:5.5.21-4.el6
  • php55-php-fpm-0:5.5.21-4.el7
  • php55-php-gd-0:5.5.21-4.el6
  • php55-php-gd-0:5.5.21-4.el7
  • php55-php-gmp-0:5.5.21-4.el6
  • php55-php-gmp-0:5.5.21-4.el7
  • php55-php-imap-0:5.5.21-4.el6
  • php55-php-intl-0:5.5.21-4.el6
  • php55-php-intl-0:5.5.21-4.el7
  • php55-php-ldap-0:5.5.21-4.el6
  • php55-php-ldap-0:5.5.21-4.el7
  • php55-php-mbstring-0:5.5.21-4.el6
  • php55-php-mbstring-0:5.5.21-4.el7
  • php55-php-mysqlnd-0:5.5.21-4.el6
  • php55-php-mysqlnd-0:5.5.21-4.el7
  • php55-php-odbc-0:5.5.21-4.el6
  • php55-php-odbc-0:5.5.21-4.el7
  • php55-php-opcache-0:5.5.21-4.el6
  • php55-php-opcache-0:5.5.21-4.el7
  • php55-php-pdo-0:5.5.21-4.el6
  • php55-php-pdo-0:5.5.21-4.el7
  • php55-php-pgsql-0:5.5.21-4.el6
  • php55-php-pgsql-0:5.5.21-4.el7
  • php55-php-process-0:5.5.21-4.el6
  • php55-php-process-0:5.5.21-4.el7
  • php55-php-pspell-0:5.5.21-4.el6
  • php55-php-pspell-0:5.5.21-4.el7
  • php55-php-recode-0:5.5.21-4.el6
  • php55-php-recode-0:5.5.21-4.el7
  • php55-php-snmp-0:5.5.21-4.el6
  • php55-php-snmp-0:5.5.21-4.el7
  • php55-php-soap-0:5.5.21-4.el6
  • php55-php-soap-0:5.5.21-4.el7
  • php55-php-tidy-0:5.5.21-4.el6
  • php55-php-xml-0:5.5.21-4.el6
  • php55-php-xml-0:5.5.21-4.el7
  • php55-php-xmlrpc-0:5.5.21-4.el6
  • php55-php-xmlrpc-0:5.5.21-4.el7
  • rh-php56-php-0:5.6.5-7.el6
  • rh-php56-php-0:5.6.5-7.el7
  • rh-php56-php-bcmath-0:5.6.5-7.el6
  • rh-php56-php-bcmath-0:5.6.5-7.el7
  • rh-php56-php-cli-0:5.6.5-7.el6
  • rh-php56-php-cli-0:5.6.5-7.el7
  • rh-php56-php-common-0:5.6.5-7.el6
  • rh-php56-php-common-0:5.6.5-7.el7
  • rh-php56-php-dba-0:5.6.5-7.el6
  • rh-php56-php-dba-0:5.6.5-7.el7
  • rh-php56-php-dbg-0:5.6.5-7.el6
  • rh-php56-php-dbg-0:5.6.5-7.el7
  • rh-php56-php-debuginfo-0:5.6.5-7.el6
  • rh-php56-php-debuginfo-0:5.6.5-7.el7
  • rh-php56-php-devel-0:5.6.5-7.el6
  • rh-php56-php-devel-0:5.6.5-7.el7
  • rh-php56-php-embedded-0:5.6.5-7.el6
  • rh-php56-php-embedded-0:5.6.5-7.el7
  • rh-php56-php-enchant-0:5.6.5-7.el6
  • rh-php56-php-enchant-0:5.6.5-7.el7
  • rh-php56-php-fpm-0:5.6.5-7.el6
  • rh-php56-php-fpm-0:5.6.5-7.el7
  • rh-php56-php-gd-0:5.6.5-7.el6
  • rh-php56-php-gd-0:5.6.5-7.el7
  • rh-php56-php-gmp-0:5.6.5-7.el6
  • rh-php56-php-gmp-0:5.6.5-7.el7
  • rh-php56-php-imap-0:5.6.5-7.el6
  • rh-php56-php-intl-0:5.6.5-7.el6
  • rh-php56-php-intl-0:5.6.5-7.el7
  • rh-php56-php-ldap-0:5.6.5-7.el6
  • rh-php56-php-ldap-0:5.6.5-7.el7
  • rh-php56-php-mbstring-0:5.6.5-7.el6
  • rh-php56-php-mbstring-0:5.6.5-7.el7
  • rh-php56-php-mysqlnd-0:5.6.5-7.el6
  • rh-php56-php-mysqlnd-0:5.6.5-7.el7
  • rh-php56-php-odbc-0:5.6.5-7.el6
  • rh-php56-php-odbc-0:5.6.5-7.el7
  • rh-php56-php-opcache-0:5.6.5-7.el6
  • rh-php56-php-opcache-0:5.6.5-7.el7
  • rh-php56-php-pdo-0:5.6.5-7.el6
  • rh-php56-php-pdo-0:5.6.5-7.el7
  • rh-php56-php-pgsql-0:5.6.5-7.el6
  • rh-php56-php-pgsql-0:5.6.5-7.el7
  • rh-php56-php-process-0:5.6.5-7.el6
  • rh-php56-php-process-0:5.6.5-7.el7
  • rh-php56-php-pspell-0:5.6.5-7.el6
  • rh-php56-php-pspell-0:5.6.5-7.el7
  • rh-php56-php-recode-0:5.6.5-7.el6
  • rh-php56-php-recode-0:5.6.5-7.el7
  • rh-php56-php-snmp-0:5.6.5-7.el6
  • rh-php56-php-snmp-0:5.6.5-7.el7
  • rh-php56-php-soap-0:5.6.5-7.el6
  • rh-php56-php-soap-0:5.6.5-7.el7
  • rh-php56-php-tidy-0:5.6.5-7.el6
  • rh-php56-php-xml-0:5.6.5-7.el6
  • rh-php56-php-xml-0:5.6.5-7.el7
  • rh-php56-php-xmlrpc-0:5.6.5-7.el6
  • rh-php56-php-xmlrpc-0:5.6.5-7.el7
  • php-0:5.3.3-46.el6_6
  • php-bcmath-0:5.3.3-46.el6_6
  • php-cli-0:5.3.3-46.el6_6
  • php-common-0:5.3.3-46.el6_6
  • php-dba-0:5.3.3-46.el6_6
  • php-debuginfo-0:5.3.3-46.el6_6
  • php-devel-0:5.3.3-46.el6_6
  • php-embedded-0:5.3.3-46.el6_6
  • php-enchant-0:5.3.3-46.el6_6
  • php-fpm-0:5.3.3-46.el6_6
  • php-gd-0:5.3.3-46.el6_6
  • php-imap-0:5.3.3-46.el6_6
  • php-intl-0:5.3.3-46.el6_6
  • php-ldap-0:5.3.3-46.el6_6
  • php-mbstring-0:5.3.3-46.el6_6
  • php-mysql-0:5.3.3-46.el6_6
  • php-odbc-0:5.3.3-46.el6_6
  • php-pdo-0:5.3.3-46.el6_6
  • php-pgsql-0:5.3.3-46.el6_6
  • php-process-0:5.3.3-46.el6_6
  • php-pspell-0:5.3.3-46.el6_6
  • php-recode-0:5.3.3-46.el6_6
  • php-snmp-0:5.3.3-46.el6_6
  • php-soap-0:5.3.3-46.el6_6
  • php-tidy-0:5.3.3-46.el6_6
  • php-xml-0:5.3.3-46.el6_6
  • php-xmlrpc-0:5.3.3-46.el6_6
  • php-zts-0:5.3.3-46.el6_6
  • php54-php-0:5.4.40-3.el6
  • php54-php-0:5.4.40-3.el7
  • php54-php-bcmath-0:5.4.40-3.el6
  • php54-php-bcmath-0:5.4.40-3.el7
  • php54-php-cli-0:5.4.40-3.el6
  • php54-php-cli-0:5.4.40-3.el7
  • php54-php-common-0:5.4.40-3.el6
  • php54-php-common-0:5.4.40-3.el7
  • php54-php-dba-0:5.4.40-3.el6
  • php54-php-dba-0:5.4.40-3.el7
  • php54-php-debuginfo-0:5.4.40-3.el6
  • php54-php-debuginfo-0:5.4.40-3.el7
  • php54-php-devel-0:5.4.40-3.el6
  • php54-php-devel-0:5.4.40-3.el7
  • php54-php-enchant-0:5.4.40-3.el6
  • php54-php-enchant-0:5.4.40-3.el7
  • php54-php-fpm-0:5.4.40-3.el6
  • php54-php-fpm-0:5.4.40-3.el7
  • php54-php-gd-0:5.4.40-3.el6
  • php54-php-gd-0:5.4.40-3.el7
  • php54-php-imap-0:5.4.40-3.el6
  • php54-php-intl-0:5.4.40-3.el6
  • php54-php-intl-0:5.4.40-3.el7
  • php54-php-ldap-0:5.4.40-3.el6
  • php54-php-ldap-0:5.4.40-3.el7
  • php54-php-mbstring-0:5.4.40-3.el6
  • php54-php-mbstring-0:5.4.40-3.el7
  • php54-php-mysqlnd-0:5.4.40-3.el6
  • php54-php-mysqlnd-0:5.4.40-3.el7
  • php54-php-odbc-0:5.4.40-3.el6
  • php54-php-odbc-0:5.4.40-3.el7
  • php54-php-pdo-0:5.4.40-3.el6
  • php54-php-pdo-0:5.4.40-3.el7
  • php54-php-pgsql-0:5.4.40-3.el6
  • php54-php-pgsql-0:5.4.40-3.el7
  • php54-php-process-0:5.4.40-3.el6
  • php54-php-process-0:5.4.40-3.el7
  • php54-php-pspell-0:5.4.40-3.el6
  • php54-php-pspell-0:5.4.40-3.el7
  • php54-php-recode-0:5.4.40-3.el6
  • php54-php-recode-0:5.4.40-3.el7
  • php54-php-snmp-0:5.4.40-3.el6
  • php54-php-snmp-0:5.4.40-3.el7
  • php54-php-soap-0:5.4.40-3.el6
  • php54-php-soap-0:5.4.40-3.el7
  • php54-php-tidy-0:5.4.40-3.el6
  • php54-php-xml-0:5.4.40-3.el6
  • php54-php-xml-0:5.4.40-3.el7
  • php54-php-xmlrpc-0:5.4.40-3.el6
  • php54-php-xmlrpc-0:5.4.40-3.el7