Vulnerabilities > CVE-2016-4543 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
hp
php
fedoraproject
opensuse
CWE-119
critical
nessus

Summary

The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data.

Vulnerable Configurations

Part Description Count
Application
Hp
85
Application
Php
739
OS
Fedoraproject
1
OS
Opensuse
1

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-499.NASL
    description - CVE-2015-8865 The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file. - CVE-2015-8866 libxml_disable_entity_loader setting is shared between threads ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161. - CVE-2015-8878 main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows remote attackers to cause a denial of service (race condition and heap memory corruption) by leveraging an application that performs many temporary-file accesses. - CVE-2015-8879 The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table. - CVE-2016-4070 Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. - CVE-2016-4071 Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via format string specifiers in an SNMP::get call. - CVE-2016-4072 The Phar extension in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename, as demonstrated by mishandling of \0 characters by the phar_analyze_path function in ext/phar/phar.c. - CVE-2016-4073 Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted mb_strcut call. - CVE-2016-4343 The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size ././@LongLink files, which allows remote attackers to cause a denial of service (uninitialized pointer dereference) or possibly have unspecified other impact via a crafted TAR archive. - CVE-2016-4537 The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a negative integer for the scale argument, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted call. - CVE-2016-4539 The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (buffer under-read and segmentation fault) or possibly have unspecified other impact via crafted XML data in the second argument, leading to a parser level of zero. - CVE-2016-4540 - CVE-2016-4541 The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a negative offset. - CVE-2016-4542 - CVE-2016-4543 - CVE-2016-4544 The exif_process_* function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 does not validate IFD sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted header data. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2016-06-01
    plugin id91397
    published2016-06-01
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91397
    titleDebian DLA-499-1 : php5 security update
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Debian Security Advisory DLA-499-1. The text
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91397);
      script_version("2.12");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id("CVE-2015-8865", "CVE-2015-8866", "CVE-2015-8878", "CVE-2015-8879", "CVE-2016-4070", "CVE-2016-4071", "CVE-2016-4072", "CVE-2016-4073", "CVE-2016-4343", "CVE-2016-4537", "CVE-2016-4539", "CVE-2016-4540", "CVE-2016-4541", "CVE-2016-4542", "CVE-2016-4543", "CVE-2016-4544");
    
      script_name(english:"Debian DLA-499-1 : php5 security update");
      script_summary(english:"Checks dpkg output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "  - CVE-2015-8865 The file_check_mem function in funcs.c in
        file before 5.23, as used in the Fileinfo component in
        PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before
        7.0.5, mishandles continuation-level jumps, which allows
        context-dependent attackers to cause a denial of service
        (buffer overflow and application crash) or possibly
        execute arbitrary code via a crafted magic file.
    
      - CVE-2015-8866 libxml_disable_entity_loader setting is
        shared between threads ext/libxml/libxml.c in PHP before
        5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used,
        does not isolate each thread from
        libxml_disable_entity_loader changes in other threads,
        which allows remote attackers to conduct XML External
        Entity (XXE) and XML Entity Expansion (XEE) attacks via
        a crafted XML document, a related issue to
        CVE-2015-5161.
    
      - CVE-2015-8878 main/php_open_temporary_file.c in PHP
        before 5.5.28 and 5.6.x before 5.6.12 does not ensure
        thread safety, which allows remote attackers to cause a
        denial of service (race condition and heap memory
        corruption) by leveraging an application that performs
        many temporary-file accesses.
    
      - CVE-2015-8879 The odbc_bindcols function in
        ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles
        driver behavior for SQL_WVARCHAR columns, which allows
        remote attackers to cause a denial of service
        (application crash) in opportunistic circumstances by
        leveraging use of the odbc_fetch_array function to
        access a certain type of Microsoft SQL Server table.
    
      - CVE-2016-4070 Integer overflow in the php_raw_url_encode
        function in ext/standard/url.c in PHP before 5.5.34,
        5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote
        attackers to cause a denial of service (application
        crash) via a long string to the rawurlencode function.
    
      - CVE-2016-4071 Format string vulnerability in the
        php_snmp_error function in ext/snmp/snmp.c in PHP before
        5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows
        remote attackers to execute arbitrary code via format
        string specifiers in an SNMP::get call.
    
      - CVE-2016-4072 The Phar extension in PHP before 5.5.34,
        5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote
        attackers to execute arbitrary code via a crafted
        filename, as demonstrated by mishandling of \0
        characters by the phar_analyze_path function in
        ext/phar/phar.c.
    
      - CVE-2016-4073 Multiple integer overflows in the
        mbfl_strcut function in
        ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before
        5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow
        remote attackers to cause a denial of service
        (application crash) or possibly execute arbitrary code
        via a crafted mb_strcut call.
    
      - CVE-2016-4343 The phar_make_dirstream function in
        ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before
        7.0.3 mishandles zero-size ././@LongLink files, which
        allows remote attackers to cause a denial of service
        (uninitialized pointer dereference) or possibly have
        unspecified other impact via a crafted TAR archive.
    
      - CVE-2016-4537 The bcpowmod function in
        ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before
        5.6.21, and 7.x before 7.0.6 accepts a negative integer
        for the scale argument, which allows remote attackers to
        cause a denial of service or possibly have unspecified
        other impact via a crafted call.
    
      - CVE-2016-4539 The xml_parse_into_struct function in
        ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21,
        and 7.x before 7.0.6 allows remote attackers to cause a
        denial of service (buffer under-read and segmentation
        fault) or possibly have unspecified other impact via
        crafted XML data in the second argument, leading to a
        parser level of zero.
    
      - CVE-2016-4540
    
      - CVE-2016-4541 The grapheme_strpos function in
        ext/intl/grapheme/grapheme_string.c in before 5.5.35,
        5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote
        attackers to cause a denial of service (out-of-bounds
        read) or possibly have unspecified other impact via a
        negative offset.
    
      - CVE-2016-4542
    
      - CVE-2016-4543
    
      - CVE-2016-4544 The exif_process_* function in
        ext/exif/exif.c in PHP before 5.5.35, 5.6.x before
        5.6.21, and 7.x before 7.0.6 does not validate IFD
        sizes, which allows remote attackers to cause a denial
        of service (out-of-bounds read) or possibly have
        unspecified other impact via crafted header data.
    
    NOTE: Tenable Network Security has extracted the preceding description
    block directly from the DLA security advisory. Tenable has attempted
    to automatically clean and format it as much as possible without
    introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://lists.debian.org/debian-lts-announce/2016/05/msg00053.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/wheezy/php5"
      );
      script_set_attribute(attribute:"solution", value:"Upgrade the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libapache2-mod-php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libapache2-mod-php5filter");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:libphp5-embed");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php-pear");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-cgi");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-cli");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-common");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-curl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-dbg");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-dev");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-enchant");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-fpm");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-gd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-gmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-imap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-interbase");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-intl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-ldap");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-mcrypt");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-mysqlnd");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-odbc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-pspell");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-recode");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-snmp");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-sqlite");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-sybase");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-tidy");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-xmlrpc");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:php5-xsl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/05/31");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/01");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"libapache2-mod-php5", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"libapache2-mod-php5filter", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"libphp5-embed", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php-pear", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-cgi", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-cli", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-common", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-curl", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-dbg", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-dev", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-enchant", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-fpm", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-gd", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-gmp", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-imap", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-interbase", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-intl", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-ldap", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-mcrypt", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-mysql", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-mysqlnd", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-odbc", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-pgsql", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-pspell", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-recode", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-snmp", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-sqlite", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-sybase", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-tidy", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-xmlrpc", reference:"5.4.45-0+deb7u3")) flag++;
    if (deb_check(release:"7.0", prefix:"php5-xsl", reference:"5.4.45-0+deb7u3")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWeb Servers
    NASL idHPSMH_7_6.NASL
    descriptionAccording to its banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.6. It is, therefore, affected by the following vulnerabilities : - A heap buffer overflow condition exists in OpenSSL in the EVP_EncodeUpdate() function within file crypto/evp/encode.c that is triggered when handling a large amount of input data. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2105) - A heap buffer overflow condition exists in OpenSSL in the EVP_EncryptUpdate() function within file crypto/evp/evp_enc.c that is triggered when handling a large amount of input data after a previous call occurs to the same function with a partial block. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-2106) - Multiple flaws exist OpenSSL in the aesni_cbc_hmac_sha1_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha1.c and the aesni_cbc_hmac_sha256_cipher() function in file crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered when the connection uses an AES-CBC cipher and AES-NI is supported by the server. A man-in-the-middle attacker can exploit these to conduct a padding oracle attack, resulting in the ability to decrypt the network traffic. (CVE-2016-2107) - Multiple unspecified flaws exist in OpenSSL in the d2i BIO functions when reading ASN.1 data from a BIO due to invalid encoding causing a large allocation of memory. An unauthenticated, remote attacker can exploit these to cause a denial of service condition through resource exhaustion. (CVE-2016-2109) - A certificate validation bypass vulnerability exists in cURL and libcurl due to improper validation of TLS certificates. A man-in-the-middle attacker can exploit this, via a spoofed certificate that appears valid, to disclose or manipulate transmitted data. (CVE-2016-3739) - An integer overflow condition exists in PHP in the php_raw_url_encode() function within file ext/standard/url.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact. (CVE-2016-4070) - A flaw exists in PHP in the php_snmp_error() function within file ext/snmp/snmp.c that is triggered when handling format string specifiers. An unauthenticated, remote attacker can exploit this, via a crafted SNMP object, to cause a denial of service or to execute arbitrary code. (CVE-2016-4071) - An invalid memory write error exists in PHP when handling the path of phar file names that allows an attacker to have an unspecified impact. (CVE-2016-4072) - A remote code execution vulnerability exists in PHP in phar_object.c due to improper handling of zero-length uncompressed data. An unauthenticated, remote attacker can exploit this, via a specially crafted TAR, ZIP, or PHAR file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-4342) - A remote code execution vulnerability exists in PHP in the phar_make_dirstream() function within file ext/phar/dirstream.c due to improper handling of ././@LongLink files. An unauthenticated, remote attacker can exploit this, via a specially crafted TAR file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-4343) - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user
    last seen2020-06-01
    modified2020-06-02
    plugin id94654
    published2016-11-09
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94654
    titleHP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(94654);
      script_version("1.12");
      script_cvs_date("Date: 2019/11/14");
    
      script_cve_id(
        "CVE-2016-2105",
        "CVE-2016-2106",
        "CVE-2016-2107",
        "CVE-2016-2109",
        "CVE-2016-3739",
        "CVE-2016-4070",
        "CVE-2016-4071",
        "CVE-2016-4072",
        "CVE-2016-4342",
        "CVE-2016-4343",
        "CVE-2016-4393",
        "CVE-2016-4394",
        "CVE-2016-4395",
        "CVE-2016-4396",
        "CVE-2016-4537",
        "CVE-2016-4538",
        "CVE-2016-4539",
        "CVE-2016-4540",
        "CVE-2016-4541",
        "CVE-2016-4542",
        "CVE-2016-4543",
        "CVE-2016-5385",
        "CVE-2016-5387",
        "CVE-2016-5388"
      );
      script_bugtraq_id(
        85800,
        85801,
        85993,
        87940,
        89154,
        89179,
        89744,
        89757,
        89760,
        89844,
        90172,
        90173,
        90174,
        90726,
        91816,
        91818,
        91821,
        93961
      );
      script_xref(name:"CERT", value:"797896");
      script_xref(name:"EDB-ID", value:"39645");
      script_xref(name:"EDB-ID", value:"39653");
      script_xref(name:"EDB-ID", value:"39768");
      script_xref(name:"HP", value:"HPSBMU03653");
      script_xref(name:"HP", value:"emr_na-c05320149");
      script_xref(name:"HP", value:"PSRT110145");
      script_xref(name:"HP", value:"PSRT110263");
      script_xref(name:"HP", value:"PSRT110115");
      script_xref(name:"HP", value:"PSRT110116");
      script_xref(name:"TRA", value:"TRA-2016-32");
      script_xref(name:"ZDI", value:"ZDI-16-587");
    
      script_name(english:"HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)");
      script_summary(english:"Performs a banner check.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its banner, the version of HP System Management Homepage
    (SMH) hosted on the remote web server is prior to 7.6. It is,
    therefore, affected by the following vulnerabilities :
    
      - A heap buffer overflow condition exists in OpenSSL in
        the EVP_EncodeUpdate() function within file
        crypto/evp/encode.c that is triggered when handling
        a large amount of input data. An unauthenticated, remote
        attacker can exploit this to cause a denial of service
        condition. (CVE-2016-2105)
    
      - A heap buffer overflow condition exists in OpenSSL in
        the EVP_EncryptUpdate() function within file
        crypto/evp/evp_enc.c that is triggered when handling a
        large amount of input data after a previous call occurs
        to the same function with a partial block. An
        unauthenticated, remote attacker can exploit this to
        cause a denial of service condition. (CVE-2016-2106)
    
      - Multiple flaws exist OpenSSL in the
        aesni_cbc_hmac_sha1_cipher() function in file
        crypto/evp/e_aes_cbc_hmac_sha1.c and the
        aesni_cbc_hmac_sha256_cipher() function in file
        crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered
        when the connection uses an AES-CBC cipher and AES-NI
        is supported by the server. A man-in-the-middle attacker
        can exploit these to conduct a padding oracle attack,
        resulting in the ability to decrypt the network traffic.
        (CVE-2016-2107)
    
      - Multiple unspecified flaws exist in OpenSSL in the d2i
        BIO functions when reading ASN.1 data from a BIO due to
        invalid encoding causing a large allocation of memory.
        An unauthenticated, remote attacker can exploit these to
        cause a denial of service condition through resource
        exhaustion. (CVE-2016-2109)
    
      - A certificate validation bypass vulnerability exists in
        cURL and libcurl due to improper validation of TLS
        certificates. A man-in-the-middle attacker can exploit
        this, via a spoofed certificate that appears valid, to
        disclose or manipulate transmitted data. (CVE-2016-3739)
    
      - An integer overflow condition exists in PHP in the
        php_raw_url_encode() function within file
        ext/standard/url.c due to improper validation of
        user-supplied input. An unauthenticated, remote attacker
        can exploit this to have an unspecified impact.
        (CVE-2016-4070)
        
      - A flaw exists in PHP in the php_snmp_error() function
        within file ext/snmp/snmp.c that is triggered when
        handling format string specifiers. An unauthenticated,
        remote attacker can exploit this, via a crafted SNMP
        object, to cause a denial of service or to execute
        arbitrary code. (CVE-2016-4071)
    
      - An invalid memory write error exists in PHP when
        handling the path of phar file names that allows an
        attacker to have an unspecified impact. (CVE-2016-4072)
    
      - A remote code execution vulnerability exists in PHP in
        phar_object.c due to improper handling of zero-length
        uncompressed data. An unauthenticated, remote attacker
        can exploit this, via a specially crafted TAR, ZIP, or
        PHAR file, to cause a denial of service condition or the
        execution of arbitrary code. (CVE-2016-4342)
    
      - A remote code execution vulnerability exists in PHP in
        the phar_make_dirstream() function within file
        ext/phar/dirstream.c due to improper handling of
        ././@LongLink files. An unauthenticated, remote attacker
        can exploit this, via a specially crafted TAR file, to
        cause a denial of service condition or the execution of
        arbitrary code. (CVE-2016-4343)
    
      - A cross-site scripting (XSS) vulnerability exists due to
        improper validation of user-supplied input. An
        unauthenticated, remote attacker can exploit this, via a
        specially crafted request, to execute arbitrary script
        code in a user's browser session. (CVE-2016-4393)
    
      - An unspecified HTTP Strict Transport Security (HSTS)
        bypass vulnerability exists that allows authenticated,
        remote attackers to disclose sensitive information.
        (CVE-2016-4394)
    
      - A remote code execution vulnerability exists due to an
        overflow condition in the mod_smh_config.so library
        caused by improper validation of user-supplied input
        when parsing the admin-group parameter supplied to the
        /proxy/SetSMHData endpoint. An unauthenticated, remote
        attacker can exploit this, via a specially crafted
        request, to cause a denial of service condition or the
        execution of arbitrary code. (CVE-2016-4395)
    
      - A remote code execution vulnerability exists due to an
        overflow condition in the mod_smh_config.so library
        caused by improper validation of user-supplied input
        when parsing the TKN parameter supplied to the
        /Proxy/SSO endpoint. An unauthenticated, remote
        attacker can exploit this, via a specially crafted
        request, to cause a denial of service condition or the
        execution of arbitrary code. (CVE-2016-4396)
    
      - An out-of-bounds read error exists in PHP in the
        php_str2num() function in bcmath.c when handling
        negative scales. An unauthenticated, remote attacker can
        exploit this, via a crafted call, to cause a denial of
        service condition or the disclosure of memory contents.
        (CVE-2016-4537)
    
      - A flaw exists in PHP the bcpowmod() function in bcmath.c
        due to modifying certain data structures without
        considering whether they are copies of the _zero_,
        _one_, or _two_ global variables. An unauthenticated,
        remote attacker can exploit this, via a crafted call, to
        cause a denial of service condition. (CVE-2016-4538)
    
      - A flaw exists in PHP in the xml_parse_into_struct()
        function in xml.c when handling specially crafted XML
        contents. An unauthenticated, remote attacker can
        exploit this to cause a denial of service condition.
        (CVE-2016-4539)
    
      - Multiple out-of-bounds read errors exist in PHP within
        file ext/intl/grapheme/grapheme_string.c when handling
        negative offsets in the zif_grapheme_stripos() and
        zif_grapheme_strpos() functions. An unauthenticated,
        remote attacker can exploit these issues to cause a
        denial of service condition or disclose memory contents.
        (CVE-2016-4540, CVE-2016-4541)
    
      - A flaw exists in PHP in the exif_process_IFD_TAG()
        function in exif.c due to improper construction of
        spprintf arguments. An unauthenticated, remote attacker
        can exploit this, via crafted header data, to cause an
        out-of-bounds read error, resulting in a denial of
        service condition or the disclosure of memory contents.
        (CVE-2016-4542)
    
      - A flaw exists in PHP in the exif_process_IFD_in_JPEG()
        function in exif.c due to improper validation of IFD
        sizes. An unauthenticated, remote attacker can exploit
        this, via crafted header data, to cause an out-of-bounds
        read error, resulting in a denial of service condition
        or the disclosure of memory contents. (CVE-2016-4543)
    
      - A man-in-the-middle vulnerability exists, known as
        'httpoxy', in the Apache Tomcat, Apache HTTP Server, and
        PHP components due to a failure to properly resolve
        namespace conflicts in accordance with RFC 3875 section
        4.1.18. The HTTP_PROXY environment variable is set based
        on untrusted user data in the 'Proxy' header of HTTP
        requests. The HTTP_PROXY environment variable is used by
        some web client libraries to specify a remote proxy
        server. A remote attacker can exploit this, via a
        crafted 'Proxy' header in an HTTP request, to redirect
        an application's internal HTTP traffic to an arbitrary
        proxy server where it may be observed or manipulated.
        (CVE-2016-5385, CVE-2016-5387, CVE-2016-5388)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      # https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c05320149
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b7e1b347");
      script_set_attribute(attribute:"see_also", value:"https://httpoxy.org");
      script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/research/tra-2016-32");
      script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-16-587/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to HP System Management Homepage (SMH) version 7.6 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-4342");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"in_the_news", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/10/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/10/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/09");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:system_management_homepage");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Web Servers");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("compaq_wbem_detect.nasl", "os_fingerprint.nasl");
      script_require_keys("www/hp_smh");
      script_require_ports("Services/www", 2301, 2381);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    # Only Linux and Windows are affected -- HP-UX is not mentioned
    os = get_kb_item_or_exit("Host/OS");
    if ("Windows" >!< os && "Linux" >!< os) audit(AUDIT_OS_NOT, "Windows or Linux", os);
    
    port = get_http_port(default:2381, embedded:TRUE);
    app = "hp_smh";
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    install = get_single_install(
      app_name : app,
      port     : port,
      exit_if_unknown_ver : TRUE
    );
    
    dir = install['dir'];
    version = install['version'];
    prod = get_kb_item_or_exit("www/"+port+"/hp_smh/variant");
    source_line = get_kb_item("www/"+port+"/hp_smh/source");
    
    if (version == UNKNOWN_VER) audit(AUDIT_UNKNOWN_WEB_APP_VER, prod, build_url(port:port, qs:dir+"/") );
    
    # nb: 'version' can have non-numeric characters in it so we'll create
    #     an alternate form and make sure that's safe for use in 'ver_compare()'.
    version_alt = ereg_replace(pattern:"[_-]", replace:".", string:version);
    if (!ereg(pattern:"^[0-9][0-9.]+$", string:version_alt))
      audit(AUDIT_VER_FORMAT, version);
    
    if (ver_compare(ver:version_alt, fix:"7.6", strict:FALSE) == -1)
    {
      report = '\n  Product           : ' + prod;
      if (!isnull(source_line))
        report += '\n  Version source    : ' + source_line;
      report +=
        '\n  Installed version : ' + version +
        '\n  Fixed version     : 7.6' +
        '\n';
    
      security_report_v4(severity:SECURITY_HOLE, port:port, extra:report, xss:TRUE);
      exit(0);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, prod, port, version);
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-613.NASL
    descriptionThis update for libqt5-qtbase fixes the following issues : - boo#865241: disable RC4 based ciphers which are now considered insecure The following non-security bugs were fixed : - boo#957006: dolphin freeze when opening a folder containing symlinks to special files
    last seen2020-06-05
    modified2016-03-03
    plugin id89093
    published2016-03-03
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89093
    titleopenSUSE Security Update : libqt5-qtbase (openSUSE-2016-613)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1638-1.NASL
    descriptionThis update for php53 to version 5.3.17 fixes the following issues : These security issues were fixed : - CVE-2016-5093: get_icu_value_internal out-of-bounds read (bnc#982010). - CVE-2016-5094: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id93161
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93161
    titleSUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)
  • NASL familyCGI abuses
    NASL idPHP_7_0_6.NASL
    descriptionAccording to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.6. It is, therefore, affected by multiple vulnerabilities : - A signedness error exists in the GD Graphics library within file gd_gd2.c due to improper validation of user-supplied input when handling compressed GD2 data. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-3074) - An integer overflow condition exists in ZipArchive in the getFromIndex() and getFromName() functions due to improper validation of user-supplied input when handling specially crafted ZIP files. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-3078) - An out-of-bounds read error exists within file ext/intl/grapheme/grapheme_string.c when handling negative offsets in the zif_grapheme_stripos() function. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. - An out-of-bounds read error exists in the php_str2num() function within file ext/bcmath/bcmath.c when handling negative scales. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - An out-of-bounds read error exists in the exif_read_data() function within file ext/exif/exif.c when handling exif headers. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - A flaw exists in the xml_parse_into_struct() function within file ext/xml/xml.c when handling specially crafted XML contents. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id90922
    published2016-05-05
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90922
    titlePHP 7.0.x < 7.0.6 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1504-1.NASL
    descriptionThis update for php5 fixes the following issues : Security issues fixed : - CVE-2016-4346: heap overflow in ext/standard/string.c (bsc#977994) - CVE-2016-4342: heap corruption in tar/zip/phar parser (bsc#977991) - CVE-2016-4537, CVE-2016-4538: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition (bsc#978827) - CVE-2016-4539: Malformed input causes segmentation fault in xml_parse_into_struct() function (bsc#978828) - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read in zif_grapheme_stripos when given negative offset (bsc#978829) - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544: Out-of-bounds heap memory read in exif_read_data() caused by malformed input (bsc#978830) - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function (bsc#980366) - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c (bsc#980373) - CVE-2015-8874: Stack consumption vulnerability in GD (bsc#980375) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-24
    modified2019-01-02
    plugin id119978
    published2019-01-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119978
    titleSUSE SLES12 Security Update : php5 (SUSE-SU-2016:1504-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2649.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ** DISPUTED ** Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial of service (application crash) via a long string to the rawurlencode function. NOTE: the vendor says
    last seen2020-05-08
    modified2019-12-18
    plugin id132184
    published2019-12-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/132184
    titleEulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-696.NASL
    descriptionThis update for php5 fixes the following issues : Security issues fixed : - CVE-2016-4346: heap overflow in ext/standard/string.c (bsc#977994) - CVE-2016-4342: heap corruption in tar/zip/phar parser (bsc#977991) - CVE-2016-4537, CVE-2016-4538: bcpowmod accepts negative scale causing heap buffer overflow corrupting _one_ definition (bsc#978827) - CVE-2016-4539: Malformed input causes segmentation fault in xml_parse_into_struct() function (bsc#978828) - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read in zif_grapheme_stripos when given negative offset (bsc#978829) - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544: Out-of-bounds heap memory read in exif_read_data() caused by malformed input (bsc#978830) - CVE-2015-4116: Use-after-free vulnerability in the spl_ptr_heap_insert function (bsc#980366) - CVE-2015-8873: Stack consumption vulnerability in Zend/zend_exceptions.c (bsc#980373) - CVE-2015-8874: Stack consumption vulnerability in GD (bsc#980375) This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2016-06-09
    plugin id91531
    published2016-06-09
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/91531
    titleopenSUSE Security Update : php5 (openSUSE-2016-696)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2221.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.(CVE-2016-7124) - Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.(CVE-2016-2554) - A flaw was discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.(CVE-2015-6831) - The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 supports deprecated line folding without considering browser compatibility, which allows remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer by leveraging (1) %0A%20 or (2) %0D%0A%20 mishandling in the header function.(CVE-2015-8935) - The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.(CVE-2015-8867) - Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.(CVE-2015-6832) - Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.(CVE-2015-6833) - Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.(CVE-2014-9767) - The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is large enough, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via a crafted PHAR archive, related to ext/phar/util.c and ext/phar/zip.c.(CVE-2016-7414) - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.(CVE-2016-9934) - The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document.(CVE-2016-9935) - In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter, related to an invalid free for an empty boolean element in ext/wddx/wddx.c.(CVE-2017-11143) - Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.(CVE-2016-5094) - The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7 does not ensure the presence of a
    last seen2020-05-08
    modified2019-11-08
    plugin id130683
    published2019-11-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/130683
    titleEulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)
  • NASL familyCGI abuses
    NASL idPHP_5_6_21.NASL
    descriptionAccording to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.21. It is, therefore, affected by multiple vulnerabilities : - A signedness error exists in the GD Graphics library within file gd_gd2.c due to improper validation of user-supplied input when handling compressed GD2 data. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-3074) - An out-of-bounds read error exists within file ext/intl/grapheme/grapheme_string.c when handling negative offsets in the zif_grapheme_stripos() function. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. - An out-of-bounds read error exists in the php_str2num() function within file ext/bcmath/bcmath.c when handling negative scales. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - An out-of-bounds read error exists in the exif_read_data() function within file ext/exif/exif.c when handling exif headers. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - A flaw exists in the xml_parse_into_struct() function within file ext/xml/xml.c when handling specially crafted XML contents. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id90921
    published2016-05-05
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90921
    titlePHP 5.6.x < 5.6.21 Multiple Vulnerabilities
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3602.NASL
    descriptionSeveral vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.22, which includes additional bug fixes. Please refer to the upstream changelog for more information : - https://php.net/ChangeLog-5.php#5.6.21 - https://php.net/ChangeLog-5.php#5.6.22
    last seen2020-06-01
    modified2020-06-02
    plugin id91615
    published2016-06-15
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91615
    titleDebian DSA-3602-1 : php5 - security update
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201611-22.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201611-22 (PHP: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in PHP. Please review the CVE identifiers referenced below for details. Impact : An attacker can possibly execute arbitrary code or create a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id95421
    published2016-12-01
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95421
    titleGLSA-201611-22 : PHP: Multiple vulnerabilities (httpoxy)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2016-F4E73663F4.NASL
    description28 Apr 2016, **PHP 5.6.21** ** Core: ** * Fixed bug #69537 (__debugInfo with empty string for key gives error). (krakjoe) * Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence) **BCmath:** * Fixed bug #72093 (bcpowmod accepts negative scale and corrupts _one_ definition). (Stas) **Curl:** * Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string). (Michael Sierks) **Date:** * Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt) **EXIF:** * Fixed bug #72094 (Out of bounds heap read access in exif header processing). (Stas) **GD:** * Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas) * Fixed bug #71912 (libgd: signedness vulnerability). (Stas) **Intl:** * Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative offset). (Stas) **OCI8:** * Fixed bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column). (Chris Jones) **ODBC:** * Fixed bug #63171 (Script hangs after max_execution_time). (Remi) **Opcache:** * Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER). (Laruence) **PDO:** * Fixed bug #52098 (Own PDOStatement implementation ignore __call()). (Daniel Kalaspuffar, Julien) * Fixed bug #71447 (Quotes inside comments not properly handled). (Matteo) **Postgres:** * Fixed bug #71820 (pg_fetch_object binds parameters before call constructor). (Anatol) **SPL:** * Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails offsetExists()). (Nikita) **Standard:** * Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence) * Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or _REENTRANT is not defined). (Nikita) **XML:** * Fixed bug #72099 (xml_parse_into_struct segmentation fault). (Stas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2016-05-09
    plugin id90978
    published2016-05-09
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/90978
    titleFedora 24 : php-5.6.21-1.fc24 (2016-f4e73663f4)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-2984-1.NASL
    descriptionIt was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865) Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078) It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132) It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4070) It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071) It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072) It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073) It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-4342, CVE-2016-4343) It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4537, CVE-2016-4538) It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4539) It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4540, CVE-2016-4541) It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id91320
    published2016-05-25
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91320
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : php5, php7.0 vulnerabilities (USN-2984-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1581-1.NASL
    descriptionThis update for php53 fixes the following issues : - CVE-2016-5093: A get_icu_value_internal out-of-bounds read could crash the php interpreter (bsc#982010) - CVE-2016-5094,CVE-2016-5095: Don
    last seen2020-06-01
    modified2020-06-02
    plugin id91665
    published2016-06-17
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91665
    titleSUSE SLES11 Security Update : php53 (SUSE-SU-2016:1581-1)
  • NASL familyMisc.
    NASL idSECURITYCENTER_PHP_5_6_21.NASL
    descriptionThe Tenable SecurityCenter application installed on the remote host is either prior to version 5.3.2 or is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP : - A signedness error exists in the GD Graphics library in gd_gd2.c due to improper validation of user-supplied input when handling compressed GD2 data. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-3074) - An out-of-bounds read error exists in the php_str2num() function in bcmath.c when handling negative scales. An unauthenticated, remote attacker can exploit this, via a crafted call, to cause a denial of service condition or the disclosure of memory contents. (CVE-2016-4537) - A flaw exists in the bcpowmod() function in bcmath.c due to modifying certain data structures without considering whether they are copies of the _zero_, _one_, or _two_ global variables. An unauthenticated, remote attacker can exploit this, via a crafted call, to cause a denial of service condition. (CVE-2016-4538) - A flaw exists in the xml_parse_into_struct() function in xml.c when handling specially crafted XML contents. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-4539) - Multiple out-of-bounds read errors exist within file ext/intl/grapheme/grapheme_string.c when handling negative offsets in the zif_grapheme_stripos() and zif_grapheme_strpos() functions. An unauthenticated, remote attacker can exploit these issues to cause a denial of service condition or disclose memory contents. (CVE-2016-4540, CVE-2016-4541) - A flaw exists in the exif_process_IFD_TAG() function in exif.c due to improper construction of spprintf arguments. An unauthenticated, remote attacker can exploit this, via crafted header data, to cause an out-of-bounds read error, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-4542) - A flaw exists in the exif_process_IFD_in_JPEG() function in exif.c due to improper validation of IFD sizes. An unauthenticated, remote attacker can exploit this, via crafted header data, to cause an out-of-bounds read error, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-4543) - A flaw exists in the exif_process_TIFF_in_JPEG() function in exif.c due to improper validation of TIFF start data. An unauthenticated, remote attacker can exploit this, via crafted header data, to cause an out-of-bounds read error, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-4544) Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id91814
    published2016-06-24
    reporterThis script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91814
    titleTenable SecurityCenter < 5.3.2 Multiple Vulnerabilities (TNS-2016-09)
  • NASL familyCGI abuses
    NASL idPHP_5_5_35.NASL
    descriptionAccording to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.35. It is, therefore, affected by multiple vulnerabilities : - A signedness error exists in the GD Graphics library within file gd_gd2.c due to improper validation of user-supplied input when handling compressed GD2 data. An unauthenticated, remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2016-3074) - An out-of-bounds read error exists within file ext/intl/grapheme/grapheme_string.c when handling negative offsets in the zif_grapheme_stripos() function. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. - An out-of-bounds read error exists in the php_str2num() function within file ext/bcmath/bcmath.c when handling negative scales. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - An out-of-bounds read error exists in the exif_read_data() function within file ext/exif/exif.c when handling exif headers. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. - A flaw exists in the xml_parse_into_struct() function within file ext/xml/xml.c when handling specially crafted XML contents. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id90920
    published2016-05-05
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/90920
    titlePHP 5.5.x < 5.5.35 Multiple Vulnerabilities
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-2438.NASL
    descriptionAccording to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.(CVE-2019-11043) - The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to a buffer over-read while unserializing untrusted data. Exploitation of this issue can have an unspecified impact on the integrity of PHP.(CVE-2017-12933) - ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that leads to a (1) __destruct call or (2) magic method call.(CVE-2016-7124) - The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi )abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.(CVE-2015-8382) - An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.(CVE-2018-5712) - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG file.(CVE-2018-14851) - The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.(CVE-2016-7480) - ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.(CVE-2016-7411) - The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of service (application crash) in opportunistic circumstances by leveraging use of the odbc_fetch_array function to access a certain type of Microsoft SQL Server table.(CVE-2015-8879) - In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension
    last seen2020-05-08
    modified2019-12-04
    plugin id131592
    published2019-12-04
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/131592
    titleEulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)

Redhat

advisories
rhsa
idRHSA-2016:2750
rpms
  • rh-php56-0:2.3-1.el6
  • rh-php56-0:2.3-1.el7
  • rh-php56-php-0:5.6.25-1.el6
  • rh-php56-php-0:5.6.25-1.el7
  • rh-php56-php-bcmath-0:5.6.25-1.el6
  • rh-php56-php-bcmath-0:5.6.25-1.el7
  • rh-php56-php-cli-0:5.6.25-1.el6
  • rh-php56-php-cli-0:5.6.25-1.el7
  • rh-php56-php-common-0:5.6.25-1.el6
  • rh-php56-php-common-0:5.6.25-1.el7
  • rh-php56-php-dba-0:5.6.25-1.el6
  • rh-php56-php-dba-0:5.6.25-1.el7
  • rh-php56-php-dbg-0:5.6.25-1.el6
  • rh-php56-php-dbg-0:5.6.25-1.el7
  • rh-php56-php-debuginfo-0:5.6.25-1.el6
  • rh-php56-php-debuginfo-0:5.6.25-1.el7
  • rh-php56-php-devel-0:5.6.25-1.el6
  • rh-php56-php-devel-0:5.6.25-1.el7
  • rh-php56-php-embedded-0:5.6.25-1.el6
  • rh-php56-php-embedded-0:5.6.25-1.el7
  • rh-php56-php-enchant-0:5.6.25-1.el6
  • rh-php56-php-enchant-0:5.6.25-1.el7
  • rh-php56-php-fpm-0:5.6.25-1.el6
  • rh-php56-php-fpm-0:5.6.25-1.el7
  • rh-php56-php-gd-0:5.6.25-1.el6
  • rh-php56-php-gd-0:5.6.25-1.el7
  • rh-php56-php-gmp-0:5.6.25-1.el6
  • rh-php56-php-gmp-0:5.6.25-1.el7
  • rh-php56-php-imap-0:5.6.25-1.el6
  • rh-php56-php-intl-0:5.6.25-1.el6
  • rh-php56-php-intl-0:5.6.25-1.el7
  • rh-php56-php-ldap-0:5.6.25-1.el6
  • rh-php56-php-ldap-0:5.6.25-1.el7
  • rh-php56-php-mbstring-0:5.6.25-1.el6
  • rh-php56-php-mbstring-0:5.6.25-1.el7
  • rh-php56-php-mysqlnd-0:5.6.25-1.el6
  • rh-php56-php-mysqlnd-0:5.6.25-1.el7
  • rh-php56-php-odbc-0:5.6.25-1.el6
  • rh-php56-php-odbc-0:5.6.25-1.el7
  • rh-php56-php-opcache-0:5.6.25-1.el6
  • rh-php56-php-opcache-0:5.6.25-1.el7
  • rh-php56-php-pdo-0:5.6.25-1.el6
  • rh-php56-php-pdo-0:5.6.25-1.el7
  • rh-php56-php-pear-1:1.9.5-4.el6
  • rh-php56-php-pear-1:1.9.5-4.el7
  • rh-php56-php-pgsql-0:5.6.25-1.el6
  • rh-php56-php-pgsql-0:5.6.25-1.el7
  • rh-php56-php-process-0:5.6.25-1.el6
  • rh-php56-php-process-0:5.6.25-1.el7
  • rh-php56-php-pspell-0:5.6.25-1.el6
  • rh-php56-php-pspell-0:5.6.25-1.el7
  • rh-php56-php-recode-0:5.6.25-1.el6
  • rh-php56-php-recode-0:5.6.25-1.el7
  • rh-php56-php-snmp-0:5.6.25-1.el6
  • rh-php56-php-snmp-0:5.6.25-1.el7
  • rh-php56-php-soap-0:5.6.25-1.el6
  • rh-php56-php-soap-0:5.6.25-1.el7
  • rh-php56-php-tidy-0:5.6.25-1.el6
  • rh-php56-php-xml-0:5.6.25-1.el6
  • rh-php56-php-xml-0:5.6.25-1.el7
  • rh-php56-php-xmlrpc-0:5.6.25-1.el6
  • rh-php56-php-xmlrpc-0:5.6.25-1.el7
  • rh-php56-runtime-0:2.3-1.el6
  • rh-php56-runtime-0:2.3-1.el7
  • rh-php56-scldevel-0:2.3-1.el6
  • rh-php56-scldevel-0:2.3-1.el7

References