Vulnerabilities > CVE-2015-4643 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

critical

nessus

NVD

Published: 2016-05-16

Updated: 2023-11-07

Summary

Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-4022.

Vulnerable Configurations

Part	Description	Count
Application	Php PHP PHP - PHP PHP 0.1 PHP PHP 0.1.1 PHP PHP 0.2 PHP PHP 0.2.0 PHP PHP 0.2.1 PHP PHP 0.2.2 PHP PHP 0.2.3 PHP PHP 0.2.4 PHP PHP 0.3 PHP PHP 0.4 PHP PHP 0.5 PHP PHP 0.5.2 PHP PHP 0.5.3 PHP PHP 0.6 PHP PHP 0.7 PHP PHP 0.9 PHP PHP 0.9.0 PHP PHP 0.9.1 PHP PHP 0.9.2 PHP PHP 0.9.3 PHP PHP 0.9.4 PHP PHP 0.10 PHP PHP 0.11 PHP PHP 0.90 PHP PHP 0.91 PHP PHP 1.0 PHP PHP 1.0.0 PHP PHP 1.0.1 PHP PHP 1.0.2 PHP PHP 1.0.3 PHP PHP 1.0.4 PHP PHP 1.1 PHP PHP 1.1.0 PHP PHP 1.1.1 PHP PHP 1.2 PHP PHP 1.2.0 PHP PHP 1.2.1 PHP PHP 1.2.2 PHP PHP 1.2.3 PHP PHP 1.2.4 PHP PHP 1.2.5 PHP PHP 1.3 PHP PHP 1.3.1 PHP PHP 1.3.5 PHP PHP 1.4 PHP PHP 1.5 PHP PHP 2.0 PHP PHP 2.0.0 PHP PHP 2.0.1 PHP PHP 2.0.2 PHP PHP 2.0B10 PHP PHP 3.0 PHP PHP 3.0.1 PHP PHP 3.0.2 PHP PHP 3.0.3 PHP PHP 3.0.4 PHP PHP 3.0.5 PHP PHP 3.0.6 PHP PHP 3.0.7 PHP PHP 3.0.8 PHP PHP 3.0.9 PHP PHP 3.0.10 PHP PHP 3.0.11 PHP PHP 3.0.12 PHP PHP 3.0.13 PHP PHP 3.0.14 PHP PHP 3.0.15 PHP PHP 3.0.16 PHP PHP 3.0.17 PHP PHP 3.0.18 PHP PHP 4.0 PHP PHP 4.0.0 PHP PHP 4.0.1 PHP PHP 4.0.2 PHP PHP 4.0.3 PHP PHP 4.0.4 PHP PHP 4.0.5 PHP PHP 4.0.6 PHP PHP 4.0.7 PHP PHP 4.1.0 PHP PHP 4.1.1 PHP PHP 4.1.2 PHP PHP 4.1.3 PHP PHP 4.2 PHP PHP 4.2.0 PHP PHP 4.2.1 PHP PHP 4.2.2 PHP PHP 4.2.3 PHP PHP 4.2.4 PHP PHP 4.3 PHP PHP 4.3.0 PHP PHP 4.3.1 PHP PHP 4.3.2 PHP PHP 4.3.3 PHP PHP 4.3.4 PHP PHP 4.3.5 PHP PHP 4.3.6 PHP PHP 4.3.7 PHP PHP 4.3.8 PHP PHP 4.3.9 PHP PHP 4.3.10 PHP PHP 4.3.11 PHP PHP 4.4.0 PHP PHP 4.4.1 PHP PHP 4.4.2 PHP PHP 4.4.3 PHP PHP 4.4.4 PHP PHP 4.4.5 PHP PHP 4.4.6 PHP PHP 4.4.7 PHP PHP 4.4.8 PHP PHP 4.4.9 PHP PHP 5.0.0 PHP PHP 5.0.1 PHP PHP 5.0.2 PHP PHP 5.0.3 PHP PHP 5.0.4 PHP PHP 5.0.5 PHP PHP 5.1 PHP PHP 5.1.0 PHP PHP 5.1.1 PHP PHP 5.1.2 PHP PHP 5.1.3 PHP PHP 5.1.4 PHP PHP 5.1.5 PHP PHP 5.1.6 PHP PHP 5.2.0 PHP PHP 5.2.1 PHP PHP 5.2.2 PHP PHP 5.2.3 PHP PHP 5.2.4 PHP PHP 5.2.5 PHP PHP 5.2.6 PHP PHP 5.2.7 PHP PHP 5.2.8 PHP PHP 5.2.9 PHP PHP 5.2.10 PHP PHP 5.2.11 PHP PHP 5.2.12 PHP PHP 5.2.13 PHP PHP 5.2.14 PHP PHP 5.2.15 PHP PHP 5.2.16 PHP PHP 5.2.17 PHP PHP 5.3.0 PHP PHP 5.3.1 PHP PHP 5.3.2 PHP PHP 5.3.3 PHP PHP 5.3.4 PHP PHP 5.3.5 PHP PHP 5.3.6 PHP PHP 5.3.7 PHP PHP 5.3.8 PHP PHP 5.3.9 PHP PHP 5.3.10 PHP PHP 5.3.11 PHP PHP 5.3.12 PHP PHP 5.3.13 PHP PHP 5.3.14 PHP PHP 5.3.15 PHP PHP 5.3.16 PHP PHP 5.3.17 PHP PHP 5.3.18 PHP PHP 5.3.19 PHP PHP 5.3.20 PHP PHP 5.3.21 PHP PHP 5.3.22 PHP PHP 5.3.23 PHP PHP 5.3.24 PHP PHP 5.3.25 PHP PHP 5.3.26 PHP PHP 5.3.27 PHP PHP 5.3.28 PHP PHP 5.3.29 PHP PHP 5.4.0 PHP PHP 5.4.1 PHP PHP 5.4.2 PHP PHP 5.4.3 PHP PHP 5.4.4 PHP PHP 5.4.5 PHP PHP 5.4.6 PHP PHP 5.4.7 PHP PHP 5.4.8 PHP PHP 5.4.9 PHP PHP 5.4.10 PHP PHP 5.4.11 PHP PHP 5.4.12 PHP PHP 5.4.13 PHP PHP 5.4.14 PHP PHP 5.4.15 PHP PHP 5.4.16 PHP PHP 5.4.17 PHP PHP 5.4.18 PHP PHP 5.4.19 PHP PHP 5.4.20 PHP PHP 5.4.21 PHP PHP 5.4.22 PHP PHP 5.4.23 PHP PHP 5.4.24 PHP PHP 5.4.25 PHP PHP 5.4.26 PHP PHP 5.4.27 PHP PHP 5.4.28 PHP PHP 5.4.29 PHP PHP 5.4.30 PHP PHP 5.4.31 PHP PHP 5.4.32 PHP PHP 5.4.33 PHP PHP 5.4.34 PHP PHP 5.4.35 PHP PHP 5.4.36 PHP PHP 5.4.37 PHP PHP 5.4.38 PHP PHP 5.4.39 PHP PHP 5.4.40 PHP PHP 5.4.41 PHP PHP 5.5.0 PHP PHP 5.5.1 PHP PHP 5.5.2 PHP PHP 5.5.3 PHP PHP 5.5.4 PHP PHP 5.5.5 PHP PHP 5.5.6 PHP PHP 5.5.7 PHP PHP 5.5.8 PHP PHP 5.5.9 PHP PHP 5.5.10 PHP PHP 5.5.11 PHP PHP 5.5.12 PHP PHP 5.5.13 PHP PHP 5.5.14 PHP PHP 5.5.15 PHP PHP 5.5.16 PHP PHP 5.5.17 PHP PHP 5.5.18 PHP PHP 5.5.19 PHP PHP 5.5.20 PHP PHP 5.5.21 PHP PHP 5.5.22 PHP PHP 5.5.23 PHP PHP 5.5.24 PHP PHP 5.5.25 PHP PHP 5.6.0 PHP PHP 5.6.1 PHP PHP 5.6.2 PHP PHP 5.6.3 PHP PHP 5.6.4 PHP PHP 5.6.5 PHP PHP 5.6.6 PHP PHP 5.6.7 PHP PHP 5.6.8 PHP PHP 5.6.9	734
OS	Debian Debian Debian Linux 8.0 Debian Debian Linux 7.0	2
OS	Redhat Redhat Enterprise Linux Desktop 7.0 Redhat Enterprise Linux Desktop 6.0 Redhat Enterprise Linux Workstation 7.0 Redhat Enterprise Linux Workstation 6.0 Redhat Enterprise Linux Server 7.0 Redhat Enterprise Linux Server 6.0 Redhat Enterprise Linux Server AUS 6.6 Redhat Enterprise Linux Server AUS 7.3 Redhat Enterprise Linux Server AUS 7.4 Redhat Enterprise Linux Server AUS 7.6 Redhat Enterprise Linux Server EUS 7.2 Redhat Enterprise Linux Server EUS 7.1 Redhat Enterprise Linux Server EUS 7.3 Redhat Enterprise Linux Server EUS 7.4 Redhat Enterprise Linux Server EUS 7.5 Redhat Enterprise Linux Server EUS 7.6 Redhat Enterprise Linux Server EUS 6.6 Redhat Enterprise Linux Server TUS 7.3 Redhat Enterprise Linux Server TUS 7.6 Redhat Enterprise Linux Server TUS 6.6	20
OS	Oracle Oracle Linux 7 Oracle Linux 6	2

Common Weakness Enumeration (CWE)

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Buffer Overflow via Environment Variables
This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
Client-side Injection-induced Buffer Overflow
This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
Filter Failure through Buffer Overflow
In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
MIME Conversion
An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-2658-1.NASL
description	Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598) Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service. (CVE-2015-4021) Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022, CVE-2015-4643) Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could use this issue with crafted form data to cause CPU consumption, leading to a denial of service. (CVE-2015-4024) Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147) Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive information. (CVE-2015-4148) Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote attacker could possibly use these issues to obtain sensitive information or cause a denial of service. (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603) It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605) It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	84563
published	2015-07-07
reporter	Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84563
title	Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : php5 vulnerabilities (USN-2658-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-2658-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(84563); script_version("2.10"); script_cvs_date("Date: 2019/09/18 12:31:44"); script_cve_id("CVE-2015-3411", "CVE-2015-3412", "CVE-2015-4021", "CVE-2015-4022", "CVE-2015-4024", "CVE-2015-4025", "CVE-2015-4026", "CVE-2015-4147", "CVE-2015-4148", "CVE-2015-4598", "CVE-2015-4599", "CVE-2015-4600", "CVE-2015-4601", "CVE-2015-4602", "CVE-2015-4603", "CVE-2015-4604", "CVE-2015-4605", "CVE-2015-4643", "CVE-2015-4644"); script_bugtraq_id(73357, 74413, 74700, 74902, 74903, 74904, 75056, 75103, 75233, 75241, 75244, 75246, 75249, 75250, 75251, 75252, 75255, 75291, 75292); script_xref(name:"USN", value:"2658-1"); script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 14.10 / 15.04 : php5 vulnerabilities (USN-2658-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote attacker could possibly use this issue to bypass intended restrictions and create or obtain access to sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598) Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service. (CVE-2015-4021) Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022, CVE-2015-4643) Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could use this issue with crafted form data to cause CPU consumption, leading to a denial of service. (CVE-2015-4024) Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147) Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive information. (CVE-2015-4148) Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote attacker could possibly use these issues to obtain sensitive information or cause a denial of service. (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603) It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605) It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/2658-1/" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libapache2-mod-php5"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cgi"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-cli"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:php5-fpm"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.04"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/06/09"); script_set_attribute(attribute:"patch_publication_date", value:"2015/07/06"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/07"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(12\.04\|14\.04\|14\.10\|15\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 14.10 / 15.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"12.04", pkgname:"libapache2-mod-php5", pkgver:"5.3.10-1ubuntu3.19")) flag++; if (ubuntu_check(osver:"12.04", pkgname:"php5-cgi", pkgver:"5.3.10-1ubuntu3.19")) flag++; if (ubuntu_check(osver:"12.04", pkgname:"php5-cli", pkgver:"5.3.10-1ubuntu3.19")) flag++; if (ubuntu_check(osver:"12.04", pkgname:"php5-fpm", pkgver:"5.3.10-1ubuntu3.19")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"libapache2-mod-php5", pkgver:"5.5.9+dfsg-1ubuntu4.11")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"php5-cgi", pkgver:"5.5.9+dfsg-1ubuntu4.11")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"php5-cli", pkgver:"5.5.9+dfsg-1ubuntu4.11")) flag++; if (ubuntu_check(osver:"14.04", pkgname:"php5-fpm", pkgver:"5.5.9+dfsg-1ubuntu4.11")) flag++; if (ubuntu_check(osver:"14.10", pkgname:"libapache2-mod-php5", pkgver:"5.5.12+dfsg-2ubuntu4.6")) flag++; if (ubuntu_check(osver:"14.10", pkgname:"php5-cgi", pkgver:"5.5.12+dfsg-2ubuntu4.6")) flag++; if (ubuntu_check(osver:"14.10", pkgname:"php5-cli", pkgver:"5.5.12+dfsg-2ubuntu4.6")) flag++; if (ubuntu_check(osver:"14.10", pkgname:"php5-fpm", pkgver:"5.5.12+dfsg-2ubuntu4.6")) flag++; if (ubuntu_check(osver:"15.04", pkgname:"libapache2-mod-php5", pkgver:"5.6.4+dfsg-4ubuntu6.2")) flag++; if (ubuntu_check(osver:"15.04", pkgname:"php5-cgi", pkgver:"5.6.4+dfsg-4ubuntu6.2")) flag++; if (ubuntu_check(osver:"15.04", pkgname:"php5-cli", pkgver:"5.6.4+dfsg-4ubuntu6.2")) flag++; if (ubuntu_check(osver:"15.04", pkgname:"php5-fpm", pkgver:"5.6.4+dfsg-4ubuntu6.2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libapache2-mod-php5 / php5-cgi / php5-cli / php5-fpm"); }

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_CDFF0AF2149211E5A1CF002590263BF5.NASL
description	The PHP project reports : DOM and GD : - Fixed bug #69719 (Incorrect handling of paths with NULs). FTP : - Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643) Postgres : - Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)
last seen	2020-06-01
modified	2020-06-02
plugin id	84326
published	2015-06-23
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84326
title	FreeBSD : php5 -- multiple vulnerabilities (cdff0af2-1492-11e5-a1cf-002590263bf5)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2018 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(84326); script_version("2.8"); script_cvs_date("Date: 2018/12/19 13:21:18"); script_cve_id("CVE-2015-4643", "CVE-2015-4644"); script_name(english:"FreeBSD : php5 -- multiple vulnerabilities (cdff0af2-1492-11e5-a1cf-002590263bf5)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "The PHP project reports : DOM and GD : - Fixed bug #69719 (Incorrect handling of paths with NULs). FTP : - Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in heap overflow). (CVE-2015-4643) Postgres : - Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644)" ); script_set_attribute( attribute:"see_also", value:"http://www.php.net/ChangeLog-5.php#5.4.42" ); script_set_attribute( attribute:"see_also", value:"http://www.php.net/ChangeLog-5.php#5.5.26" ); script_set_attribute( attribute:"see_also", value:"http://www.php.net/ChangeLog-5.php#5.6.10" ); # http://openwall.com/lists/oss-security/2015/06/18/3 script_set_attribute( attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2015/06/18/3" ); # https://vuxml.freebsd.org/freebsd/cdff0af2-1492-11e5-a1cf-002590263bf5.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?0a8cf05d" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php5-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php5-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php5-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php5-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php55-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php55-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php55-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php55-pgsql"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php56-dom"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php56-ftp"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php56-gd"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:php56-psql"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2015/06/11"); script_set_attribute(attribute:"patch_publication_date", value:"2015/06/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2015/06/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"php5-dom<5.4.42")) flag++; if (pkg_test(save_report:TRUE, pkg:"php5-ftp<5.4.42")) flag++; if (pkg_test(save_report:TRUE, pkg:"php5-gd<5.4.42")) flag++; if (pkg_test(save_report:TRUE, pkg:"php5-pgsql<5.4.42")) flag++; if (pkg_test(save_report:TRUE, pkg:"php55-dom<5.5.26")) flag++; if (pkg_test(save_report:TRUE, pkg:"php55-ftp<5.5.26")) flag++; if (pkg_test(save_report:TRUE, pkg:"php55-gd<5.5.26")) flag++; if (pkg_test(save_report:TRUE, pkg:"php55-pgsql<5.5.26")) flag++; if (pkg_test(save_report:TRUE, pkg:"php56-dom<5.6.10")) flag++; if (pkg_test(save_report:TRUE, pkg:"php56-ftp<5.6.10")) flag++; if (pkg_test(save_report:TRUE, pkg:"php56-gd<5.6.10")) flag++; if (pkg_test(save_report:TRUE, pkg:"php56-psql<5.6.10")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	Gentoo Local Security Checks
NASL id	GENTOO_GLSA-201606-10.NASL
description	The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a Denial of Service condition. Workaround : There is no known workaround at this time.
last seen	2020-06-01
modified	2020-06-02
plugin id	91704
published	2016-06-20
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/91704
title	GLSA-201606-10 : PHP: Multiple vulnerabilities
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Gentoo Linux Security Advisory GLSA 201606-10. # # The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc. # and licensed under the Creative Commons - Attribution / Share Alike # license. See http://creativecommons.org/licenses/by-sa/3.0/ # include("compat.inc"); if (description) { script_id(91704); script_version("2.3"); script_cvs_date("Date: 2019/04/11 17:23:06"); script_cve_id("CVE-2013-6501", "CVE-2014-9705", "CVE-2014-9709", "CVE-2015-0231", "CVE-2015-0273", "CVE-2015-1351", "CVE-2015-1352", "CVE-2015-2301", "CVE-2015-2348", "CVE-2015-2783", "CVE-2015-2787", "CVE-2015-3329", "CVE-2015-3330", "CVE-2015-4021", "CVE-2015-4022", "CVE-2015-4025", "CVE-2015-4026", "CVE-2015-4147", "CVE-2015-4148", "CVE-2015-4642", "CVE-2015-4643", "CVE-2015-4644", "CVE-2015-6831", "CVE-2015-6832", "CVE-2015-6833", "CVE-2015-6834", "CVE-2015-6835", "CVE-2015-6836", "CVE-2015-6837", "CVE-2015-6838", "CVE-2015-7803", "CVE-2015-7804"); script_xref(name:"GLSA", value:"201606-10"); script_name(english:"GLSA-201606-10 : PHP: Multiple vulnerabilities"); script_summary(english:"Checks for updated package(s) in /var/db/pkg"); script_set_attribute( attribute:"synopsis", value: "The remote Gentoo host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a Denial of Service condition. Workaround : There is no known workaround at this time." ); script_set_attribute( attribute:"see_also", value:"https://security.gentoo.org/glsa/201606-10" ); script_set_attribute( attribute:"solution", value: "All PHP 5.4 users should upgrade to the latest 5.5 stable branch, as PHP 5.4 is now masked in Portage: # emerge --sync # emerge --ask --oneshot --verbose '>=dev=lang/php-5.5.33' All PHP 5.5 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev=lang/php-5.5.33' All PHP 5.6 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose '>=dev=lang/php-5.6.19'" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:php"); script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux"); script_set_attribute(attribute:"patch_publication_date", value:"2016/06/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/20"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Gentoo Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("qpkg.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo"); if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (qpkg_check(package:"dev-lang/php", unaffected:make_list("ge 5.6.19", "rge 5.5.33", "rge 5.5.34", "rge 5.5.35", "rge 5.5.36", "rge 5.5.37", "rge 5.5.38"), vulnerable:make_list("lt 5.6.19"))) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get()); else security_hole(0); exit(0); } else { tested = qpkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "PHP"); }

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2015-1218.NASL
description	From Red Hat Security Advisory 2015:1218 : Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84659
published	2015-07-13
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84659
title	Oracle Linux 6 : php (ELSA-2015-1218)

NASL family	Oracle Linux Local Security Checks
NASL id	ORACLELINUX_ELSA-2015-1135.NASL
description	From Red Hat Security Advisory 2015:1135 : Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84351
published	2015-06-24
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84351
title	Oracle Linux 7 : php (ELSA-2015-1135)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2015-1135.NASL
description	Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84355
published	2015-06-24
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84355
title	RHEL 7 : php (RHSA-2015:1135)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2015-1135.NASL
description	Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330) A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84345
published	2015-06-24
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84345
title	CentOS 7 : php (CESA-2015:1135)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2016-1638-1.NASL
description	This update for php53 to version 5.3.17 fixes the following issues : These security issues were fixed : - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don
last seen	2020-06-01
modified	2020-06-02
plugin id	93161
published	2016-08-29
reporter	This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/93161
title	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)

NASL family	CGI abuses
NASL id	PHP_5_4_42.NASL
description	According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.42. It is, therefore, affected by multiple vulnerabilities : - Multiple heap buffer overflow conditions exist in the bundled Perl-Compatible Regular Expression (PCRE) library due to improper validation of user-supplied input to the compile_branch() and pcre_compile2() functions. A remote attacker can exploit these conditions to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of quotes in collation sequence names. A remote attacker can exploit this to cause uninitialized memory access, resulting in denial of service condition. (CVE-2015-3414) - A denial of service vulnerability exists in the bundled SQLite component due to an improper implementation of comparison operators in the sqlite3VdbeExec() function in vdbe.c. A remote attacker can exploit this to cause an invalid free operation, resulting in a denial of service condition. (CVE-2015-3415) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of precision and width values during floating-point conversions in the sqlite3VXPrintf() function in printf.c. A remote attacker can exploit this to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-3416) - A security bypass vulnerability exists due to a failure in multiple extensions to check for NULL bytes in a path when processing or reading a file. A remote attacker can exploit this, by combining the
last seen	2020-06-01
modified	2020-06-02
plugin id	84362
published	2015-06-24
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84362
title	PHP 5.4.x < 5.4.42 Multiple Vulnerabilities

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2015-561.NASL
description	Upstream reports that six security-related issues in PHP were fixed in this release, as well as several security issues in bundled sqlite library (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416). All PHP 5.4 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.
last seen	2020-06-01
modified	2020-06-02
plugin id	84623
published	2015-07-09
reporter	This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/84623
title	Amazon Linux AMI : php54 (ALAS-2015-561)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2015-1253-1.NASL
description	This security update of PHP fixes the following issues : Security issues fixed : - CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data remote DOS Vulnerability. - CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check path validity. - CVE-2015-4022 [bnc#931772]: Fixed and overflow in ftp_genlist() that resulted in a heap overflow. - CVE-2015-4021 [bnc#931769]: Fixed memory corruption in phar_parse_tarfile when entry filename starts with NULL. - CVE-2015-4148 [bnc#933227]: Fixed SoapClient
last seen	2020-03-24
modified	2019-01-02
plugin id	119968
published	2019-01-02
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/119968
title	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1253-1)

NASL family	Red Hat Local Security Checks
NASL id	REDHAT-RHSA-2015-1218.NASL
description	Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84660
published	2015-07-13
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84660
title	RHEL 6 : php (RHSA-2015:1218)

NASL family	Slackware Local Security Checks
NASL id	SLACKWARE_SSA_2015-198-02.NASL
description	New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	84830
published	2015-07-20
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84830
title	Slackware 14.0 / 14.1 / current : php (SSA:2015-198-02) (BACKRONYM)

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2015-563.NASL
description	Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.6 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.
last seen	2020-06-01
modified	2020-06-02
plugin id	84625
published	2015-07-09
reporter	This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/84625
title	Amazon Linux AMI : php56 (ALAS-2015-563)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2015-471.NASL
description	The PHP script interpreter was updated to receive various security fixes : - CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. - CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. - CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. - CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. - CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. - CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions.
last seen	2020-06-05
modified	2015-07-07
plugin id	84557
published	2015-07-07
reporter	This script is Copyright (C) 2015-2020 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/84557
title	openSUSE Security Update : php5 (openSUSE-2015-471)

NASL family	CGI abuses
NASL id	PHP_5_5_26.NASL
description	According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.26. It is, therefore, affected by multiple vulnerabilities : - Multiple heap buffer overflow conditions exist in the bundled Perl-Compatible Regular Expression (PCRE) library due to improper validation of user-supplied input to the compile_branch() and pcre_compile2() functions. A remote attacker can exploit these conditions to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of quotes in collation sequence names. A remote attacker can exploit this to cause uninitialized memory access, resulting in denial of service condition. (CVE-2015-3414) - A denial of service vulnerability exists in the bundled SQLite component due to an improper implementation of comparison operators in the sqlite3VdbeExec() function in vdbe.c. A remote attacker can exploit this to cause an invalid free operation, resulting in a denial of service condition. (CVE-2015-3415) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of precision and width values during floating-point conversions in the sqlite3VXPrintf() function in printf.c. A remote attacker can exploit this to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-3416) - A security bypass vulnerability exists due to a failure in multiple extensions to check for NULL bytes in a path when processing or reading a file. A remote attacker can exploit this, by combining the
last seen	2020-06-01
modified	2020-06-02
plugin id	84363
published	2015-06-24
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84363
title	PHP 5.5.x < 5.5.26 Multiple Vulnerabilities

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DLA-307.NASL
description	- CVE-2015-3307 The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive. - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) - CVE-2015-4021 The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive. - CVE-2015-4022 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. - CVE-2015-4026 The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. - CVE-2015-4147 The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a
last seen	2020-03-17
modified	2015-09-08
plugin id	85808
published	2015-09-08
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/85808
title	Debian DLA-307-1 : php5 security update

NASL family	CGI abuses
NASL id	PHP_5_6_10.NASL
description	According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.10. It is, therefore, affected by multiple vulnerabilities : - Multiple heap buffer overflow conditions exist in the bundled Perl-Compatible Regular Expression (PCRE) library due to improper validation of user-supplied input to the compile_branch() and pcre_compile2() functions. A remote attacker can exploit these conditions to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of quotes in collation sequence names. A remote attacker can exploit this to cause uninitialized memory access, resulting in denial of service condition. (CVE-2015-3414) - A denial of service vulnerability exists in the bundled SQLite component due to an improper implementation of comparison operators in the sqlite3VdbeExec() function in vdbe.c. A remote attacker can exploit this to cause an invalid free operation, resulting in a denial of service condition. (CVE-2015-3415) - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of precision and width values during floating-point conversions in the sqlite3VXPrintf() function in printf.c. A remote attacker can exploit this to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-3416) - A security bypass vulnerability exists due to a failure in multiple extensions to check for NULL bytes in a path when processing or reading a file. A remote attacker can exploit this, by combining the
last seen	2020-06-01
modified	2020-06-02
plugin id	84364
published	2015-06-24
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84364
title	PHP 5.6.x < 5.6.10 Multiple Vulnerabilities

NASL family	Firewalls
NASL id	PFSENSE_SA-15_06.NASL
description	According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.
last seen	2020-06-01
modified	2020-06-02
plugin id	106495
published	2018-01-31
reporter	This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/106495
title	pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2015-1265-1.NASL
description	The PHP script interpreter was updated to fix various security issues : CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion. CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods. CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize. CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data. CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow. CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions. CVE-2015-4148 [bnc#933227]: Fixed a SoapClient
last seen	2020-06-01
modified	2020-06-02
plugin id	84897
published	2015-07-21
reporter	This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84897
title	SUSE SLES11 Security Update : PHP (SUSE-SU-2015:1265-1)

NASL family	Debian Local Security Checks
NASL id	DEBIAN_DSA-3344.NASL
description	Multiple vulnerabilities have been discovered in the PHP language : - CVE-2015-4598 thoger at redhat dot com discovered that paths containing a NUL character were improperly handled, thus allowing an attacker to manipulate unexpected files on the server. - CVE-2015-4643 Max Spelsberg discovered an integer overflow flaw leading to a heap-based buffer overflow in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	85664
published	2015-08-28
reporter	This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/85664
title	Debian DSA-3344-1 : php5 - security update

NASL family	Amazon Linux Local Security Checks
NASL id	ALA_ALAS-2015-562.NASL
description	Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.5 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.
last seen	2020-06-01
modified	2020-06-02
plugin id	84624
published	2015-07-09
reporter	This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.
source	https://www.tenable.com/plugins/nessus/84624
title	Amazon Linux AMI : php55 (ALAS-2015-562)

NASL family	CentOS Local Security Checks
NASL id	CENTOS_RHSA-2015-1218.NASL
description	Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024) An uninitialized pointer use flaw was found in PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	84648
published	2015-07-13
reporter	This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/84648
title	CentOS 6 : php (CESA-2015:1218)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2019-1543.NASL
description	According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaws was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.(CVE-2014-8142) - It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.(CVE-2015-4026) - A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.(CVE-2015-6834) - It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.(CVE-2015-4025) - An integer overflow flaw was found in the way custom objects were unserialized. Specially crafted input processed by the unserialize() function could cause a PHP application to crash.(CVE-2014-3669) - It was found that PHP move_uploaded_file() function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions.(CVE-2015-2348) - An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP
last seen	2020-06-01
modified	2020-06-02
plugin id	124996
published	2019-05-14
reporter	This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/124996
title	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)

Redhat

advisories

bugzilla

id	1232923
title	CVE-2015-4602 php: Incomplete Class unserialization type confusion

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment php-pspell is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135001
comment php-pspell is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195026
AND
comment php-mbstring is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135003
comment php-mbstring is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195044
AND
comment php-fpm is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135005
comment php-fpm is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20130514038
AND
comment php-snmp is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135007
comment php-snmp is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195038
AND
comment php-bcmath is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135009
comment php-bcmath is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195048
AND
comment php-embedded is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135011
comment php-embedded is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195046
AND
comment php-dba is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135013
comment php-dba is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195034
AND
comment php-process is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135015
comment php-process is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195028
AND
comment php-enchant is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135017
comment php-enchant is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195030
AND
comment php-cli is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135019
comment php-cli is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195002
AND
comment php-pdo is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135021
comment php-pdo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195024
AND
comment php-gd is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135023
comment php-gd is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195008
AND
comment php-intl is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135025
comment php-intl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195050
AND
comment php-soap is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135027
comment php-soap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195010
AND
comment php-mysqlnd is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135029
comment php-mysqlnd is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20141013034
AND
comment php-odbc is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135031
comment php-odbc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195004
AND
comment php-xml is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135033
comment php-xml is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195020
AND
comment php-xmlrpc is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135035
comment php-xmlrpc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195016
AND
comment php-ldap is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135037
comment php-ldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195012
AND
comment php-mysql is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135039
comment php-mysql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195006
AND
comment php-common is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135041
comment php-common is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195014
AND
comment php-recode is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135043
comment php-recode is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195042
AND
comment php is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135045
comment php is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195018
AND
comment php-pgsql is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135047
comment php-pgsql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195022
AND
comment php-devel is earlier than 0:5.4.16-36.el7_1
oval oval:com.redhat.rhsa:tst:20151135049
comment php-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195052

rhsa

id	RHSA-2015:1135
released	2015-06-23
severity	Important
title	RHSA-2015:1135: php security and bug fix update (Important)

bugzilla

id	1232923
title	CVE-2015-4602 php: Incomplete Class unserialization type confusion

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment php-fpm is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218001
comment php-fpm is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20130514038
AND
comment php-devel is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218003
comment php-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195052
AND
comment php-embedded is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218005
comment php-embedded is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195046
AND
comment php-pspell is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218007
comment php-pspell is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195026
AND
comment php-intl is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218009
comment php-intl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195050
AND
comment php-tidy is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218011
comment php-tidy is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195036
AND
comment php-dba is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218013
comment php-dba is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195034
AND
comment php-snmp is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218015
comment php-snmp is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195038
AND
comment php-enchant is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218017
comment php-enchant is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195030
AND
comment php-process is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218019
comment php-process is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195028
AND
comment php-imap is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218021
comment php-imap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195040
AND
comment php-recode is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218023
comment php-recode is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195042
AND
comment php-bcmath is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218025
comment php-bcmath is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195048
AND
comment php-zts is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218027
comment php-zts is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195032
AND
comment php-mbstring is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218029
comment php-mbstring is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195044
AND
comment php-gd is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218031
comment php-gd is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195008
AND
comment php-common is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218033
comment php-common is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195014
AND
comment php-mysql is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218035
comment php-mysql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195006
AND
comment php-ldap is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218037
comment php-ldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195012
AND
comment php-pdo is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218039
comment php-pdo is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195024
AND
comment php-soap is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218041
comment php-soap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195010
AND
comment php-xmlrpc is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218043
comment php-xmlrpc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195016
AND
comment php-cli is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218045
comment php-cli is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195002
AND
comment php-odbc is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218047
comment php-odbc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195004
AND
comment php-pgsql is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218049
comment php-pgsql is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195022
AND
comment php is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218051
comment php is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195018
AND
comment php-xml is earlier than 0:5.3.3-46.el6_6
oval oval:com.redhat.rhsa:tst:20151218053
comment php-xml is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20110195020

rhsa

id	RHSA-2015:1218
released	2015-07-09
severity	Moderate
title	RHSA-2015:1218: php security update (Moderate)

rhsa
id RHSA-2015:1186
rhsa
id RHSA-2015:1187

rpms

php-0:5.4.16-36.ael7b_1
php-0:5.4.16-36.el7_1
php-bcmath-0:5.4.16-36.ael7b_1
php-bcmath-0:5.4.16-36.el7_1
php-cli-0:5.4.16-36.ael7b_1
php-cli-0:5.4.16-36.el7_1
php-common-0:5.4.16-36.ael7b_1
php-common-0:5.4.16-36.el7_1
php-dba-0:5.4.16-36.ael7b_1
php-dba-0:5.4.16-36.el7_1
php-debuginfo-0:5.4.16-36.ael7b_1
php-debuginfo-0:5.4.16-36.el7_1
php-devel-0:5.4.16-36.ael7b_1
php-devel-0:5.4.16-36.el7_1
php-embedded-0:5.4.16-36.ael7b_1
php-embedded-0:5.4.16-36.el7_1
php-enchant-0:5.4.16-36.ael7b_1
php-enchant-0:5.4.16-36.el7_1
php-fpm-0:5.4.16-36.ael7b_1
php-fpm-0:5.4.16-36.el7_1
php-gd-0:5.4.16-36.ael7b_1
php-gd-0:5.4.16-36.el7_1
php-intl-0:5.4.16-36.ael7b_1
php-intl-0:5.4.16-36.el7_1
php-ldap-0:5.4.16-36.ael7b_1
php-ldap-0:5.4.16-36.el7_1
php-mbstring-0:5.4.16-36.ael7b_1
php-mbstring-0:5.4.16-36.el7_1
php-mysql-0:5.4.16-36.ael7b_1
php-mysql-0:5.4.16-36.el7_1
php-mysqlnd-0:5.4.16-36.ael7b_1
php-mysqlnd-0:5.4.16-36.el7_1
php-odbc-0:5.4.16-36.ael7b_1
php-odbc-0:5.4.16-36.el7_1
php-pdo-0:5.4.16-36.ael7b_1
php-pdo-0:5.4.16-36.el7_1
php-pgsql-0:5.4.16-36.ael7b_1
php-pgsql-0:5.4.16-36.el7_1
php-process-0:5.4.16-36.ael7b_1
php-process-0:5.4.16-36.el7_1
php-pspell-0:5.4.16-36.ael7b_1
php-pspell-0:5.4.16-36.el7_1
php-recode-0:5.4.16-36.ael7b_1
php-recode-0:5.4.16-36.el7_1
php-snmp-0:5.4.16-36.ael7b_1
php-snmp-0:5.4.16-36.el7_1
php-soap-0:5.4.16-36.ael7b_1
php-soap-0:5.4.16-36.el7_1
php-xml-0:5.4.16-36.ael7b_1
php-xml-0:5.4.16-36.el7_1
php-xmlrpc-0:5.4.16-36.ael7b_1
php-xmlrpc-0:5.4.16-36.el7_1
php55-php-0:5.5.21-4.el6
php55-php-0:5.5.21-4.el7
php55-php-bcmath-0:5.5.21-4.el6
php55-php-bcmath-0:5.5.21-4.el7
php55-php-cli-0:5.5.21-4.el6
php55-php-cli-0:5.5.21-4.el7
php55-php-common-0:5.5.21-4.el6
php55-php-common-0:5.5.21-4.el7
php55-php-dba-0:5.5.21-4.el6
php55-php-dba-0:5.5.21-4.el7
php55-php-debuginfo-0:5.5.21-4.el6
php55-php-debuginfo-0:5.5.21-4.el7
php55-php-devel-0:5.5.21-4.el6
php55-php-devel-0:5.5.21-4.el7
php55-php-enchant-0:5.5.21-4.el6
php55-php-enchant-0:5.5.21-4.el7
php55-php-fpm-0:5.5.21-4.el6
php55-php-fpm-0:5.5.21-4.el7
php55-php-gd-0:5.5.21-4.el6
php55-php-gd-0:5.5.21-4.el7
php55-php-gmp-0:5.5.21-4.el6
php55-php-gmp-0:5.5.21-4.el7
php55-php-imap-0:5.5.21-4.el6
php55-php-intl-0:5.5.21-4.el6
php55-php-intl-0:5.5.21-4.el7
php55-php-ldap-0:5.5.21-4.el6
php55-php-ldap-0:5.5.21-4.el7
php55-php-mbstring-0:5.5.21-4.el6
php55-php-mbstring-0:5.5.21-4.el7
php55-php-mysqlnd-0:5.5.21-4.el6
php55-php-mysqlnd-0:5.5.21-4.el7
php55-php-odbc-0:5.5.21-4.el6
php55-php-odbc-0:5.5.21-4.el7
php55-php-opcache-0:5.5.21-4.el6
php55-php-opcache-0:5.5.21-4.el7
php55-php-pdo-0:5.5.21-4.el6
php55-php-pdo-0:5.5.21-4.el7
php55-php-pgsql-0:5.5.21-4.el6
php55-php-pgsql-0:5.5.21-4.el7
php55-php-process-0:5.5.21-4.el6
php55-php-process-0:5.5.21-4.el7
php55-php-pspell-0:5.5.21-4.el6
php55-php-pspell-0:5.5.21-4.el7
php55-php-recode-0:5.5.21-4.el6
php55-php-recode-0:5.5.21-4.el7
php55-php-snmp-0:5.5.21-4.el6
php55-php-snmp-0:5.5.21-4.el7
php55-php-soap-0:5.5.21-4.el6
php55-php-soap-0:5.5.21-4.el7
php55-php-tidy-0:5.5.21-4.el6
php55-php-xml-0:5.5.21-4.el6
php55-php-xml-0:5.5.21-4.el7
php55-php-xmlrpc-0:5.5.21-4.el6
php55-php-xmlrpc-0:5.5.21-4.el7
rh-php56-php-0:5.6.5-7.el6
rh-php56-php-0:5.6.5-7.el7
rh-php56-php-bcmath-0:5.6.5-7.el6
rh-php56-php-bcmath-0:5.6.5-7.el7
rh-php56-php-cli-0:5.6.5-7.el6
rh-php56-php-cli-0:5.6.5-7.el7
rh-php56-php-common-0:5.6.5-7.el6
rh-php56-php-common-0:5.6.5-7.el7
rh-php56-php-dba-0:5.6.5-7.el6
rh-php56-php-dba-0:5.6.5-7.el7
rh-php56-php-dbg-0:5.6.5-7.el6
rh-php56-php-dbg-0:5.6.5-7.el7
rh-php56-php-debuginfo-0:5.6.5-7.el6
rh-php56-php-debuginfo-0:5.6.5-7.el7
rh-php56-php-devel-0:5.6.5-7.el6
rh-php56-php-devel-0:5.6.5-7.el7
rh-php56-php-embedded-0:5.6.5-7.el6
rh-php56-php-embedded-0:5.6.5-7.el7
rh-php56-php-enchant-0:5.6.5-7.el6
rh-php56-php-enchant-0:5.6.5-7.el7
rh-php56-php-fpm-0:5.6.5-7.el6
rh-php56-php-fpm-0:5.6.5-7.el7
rh-php56-php-gd-0:5.6.5-7.el6
rh-php56-php-gd-0:5.6.5-7.el7
rh-php56-php-gmp-0:5.6.5-7.el6
rh-php56-php-gmp-0:5.6.5-7.el7
rh-php56-php-imap-0:5.6.5-7.el6
rh-php56-php-intl-0:5.6.5-7.el6
rh-php56-php-intl-0:5.6.5-7.el7
rh-php56-php-ldap-0:5.6.5-7.el6
rh-php56-php-ldap-0:5.6.5-7.el7
rh-php56-php-mbstring-0:5.6.5-7.el6
rh-php56-php-mbstring-0:5.6.5-7.el7
rh-php56-php-mysqlnd-0:5.6.5-7.el6
rh-php56-php-mysqlnd-0:5.6.5-7.el7
rh-php56-php-odbc-0:5.6.5-7.el6
rh-php56-php-odbc-0:5.6.5-7.el7
rh-php56-php-opcache-0:5.6.5-7.el6
rh-php56-php-opcache-0:5.6.5-7.el7
rh-php56-php-pdo-0:5.6.5-7.el6
rh-php56-php-pdo-0:5.6.5-7.el7
rh-php56-php-pgsql-0:5.6.5-7.el6
rh-php56-php-pgsql-0:5.6.5-7.el7
rh-php56-php-process-0:5.6.5-7.el6
rh-php56-php-process-0:5.6.5-7.el7
rh-php56-php-pspell-0:5.6.5-7.el6
rh-php56-php-pspell-0:5.6.5-7.el7
rh-php56-php-recode-0:5.6.5-7.el6
rh-php56-php-recode-0:5.6.5-7.el7
rh-php56-php-snmp-0:5.6.5-7.el6
rh-php56-php-snmp-0:5.6.5-7.el7
rh-php56-php-soap-0:5.6.5-7.el6
rh-php56-php-soap-0:5.6.5-7.el7
rh-php56-php-tidy-0:5.6.5-7.el6
rh-php56-php-xml-0:5.6.5-7.el6
rh-php56-php-xml-0:5.6.5-7.el7
rh-php56-php-xmlrpc-0:5.6.5-7.el6
rh-php56-php-xmlrpc-0:5.6.5-7.el7
php-0:5.3.3-46.el6_6
php-bcmath-0:5.3.3-46.el6_6
php-cli-0:5.3.3-46.el6_6
php-common-0:5.3.3-46.el6_6
php-dba-0:5.3.3-46.el6_6
php-debuginfo-0:5.3.3-46.el6_6
php-devel-0:5.3.3-46.el6_6
php-embedded-0:5.3.3-46.el6_6
php-enchant-0:5.3.3-46.el6_6
php-fpm-0:5.3.3-46.el6_6
php-gd-0:5.3.3-46.el6_6
php-imap-0:5.3.3-46.el6_6
php-intl-0:5.3.3-46.el6_6
php-ldap-0:5.3.3-46.el6_6
php-mbstring-0:5.3.3-46.el6_6
php-mysql-0:5.3.3-46.el6_6
php-odbc-0:5.3.3-46.el6_6
php-pdo-0:5.3.3-46.el6_6
php-pgsql-0:5.3.3-46.el6_6
php-process-0:5.3.3-46.el6_6
php-pspell-0:5.3.3-46.el6_6
php-recode-0:5.3.3-46.el6_6
php-snmp-0:5.3.3-46.el6_6
php-soap-0:5.3.3-46.el6_6
php-tidy-0:5.3.3-46.el6_6
php-xml-0:5.3.3-46.el6_6
php-xmlrpc-0:5.3.3-46.el6_6
php-zts-0:5.3.3-46.el6_6
php54-php-0:5.4.40-3.el6
php54-php-0:5.4.40-3.el7
php54-php-bcmath-0:5.4.40-3.el6
php54-php-bcmath-0:5.4.40-3.el7
php54-php-cli-0:5.4.40-3.el6
php54-php-cli-0:5.4.40-3.el7
php54-php-common-0:5.4.40-3.el6
php54-php-common-0:5.4.40-3.el7
php54-php-dba-0:5.4.40-3.el6
php54-php-dba-0:5.4.40-3.el7
php54-php-debuginfo-0:5.4.40-3.el6
php54-php-debuginfo-0:5.4.40-3.el7
php54-php-devel-0:5.4.40-3.el6
php54-php-devel-0:5.4.40-3.el7
php54-php-enchant-0:5.4.40-3.el6
php54-php-enchant-0:5.4.40-3.el7
php54-php-fpm-0:5.4.40-3.el6
php54-php-fpm-0:5.4.40-3.el7
php54-php-gd-0:5.4.40-3.el6
php54-php-gd-0:5.4.40-3.el7
php54-php-imap-0:5.4.40-3.el6
php54-php-intl-0:5.4.40-3.el6
php54-php-intl-0:5.4.40-3.el7
php54-php-ldap-0:5.4.40-3.el6
php54-php-ldap-0:5.4.40-3.el7
php54-php-mbstring-0:5.4.40-3.el6
php54-php-mbstring-0:5.4.40-3.el7
php54-php-mysqlnd-0:5.4.40-3.el6
php54-php-mysqlnd-0:5.4.40-3.el7
php54-php-odbc-0:5.4.40-3.el6
php54-php-odbc-0:5.4.40-3.el7
php54-php-pdo-0:5.4.40-3.el6
php54-php-pdo-0:5.4.40-3.el7
php54-php-pgsql-0:5.4.40-3.el6
php54-php-pgsql-0:5.4.40-3.el7
php54-php-process-0:5.4.40-3.el6
php54-php-process-0:5.4.40-3.el7
php54-php-pspell-0:5.4.40-3.el6
php54-php-pspell-0:5.4.40-3.el7
php54-php-recode-0:5.4.40-3.el6
php54-php-recode-0:5.4.40-3.el7
php54-php-snmp-0:5.4.40-3.el6
php54-php-snmp-0:5.4.40-3.el7
php54-php-soap-0:5.4.40-3.el6
php54-php-soap-0:5.4.40-3.el7
php54-php-tidy-0:5.4.40-3.el6
php54-php-xml-0:5.4.40-3.el6
php54-php-xml-0:5.4.40-3.el7
php54-php-xmlrpc-0:5.4.40-3.el6
php54-php-xmlrpc-0:5.4.40-3.el7

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

Redhat

References