It was discovered that PHP did not properly check the length of the string parameter to the fnmatch function. An attacker could cause a denial of service in the PHP interpreter if a script passed untrusted input to the fnmatch function. (CVE-2007-4782)

Maksymilian Arciemowicz discovered a flaw in the cURL library that allowed safe_mode and open_basedir restrictions to be bypassed. If a PHP application were tricked into processing a bad file:// request, an attacker could read arbitrary files. (CVE-2007-4850)

Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars functions did not correctly stop when handling partial multibyte sequences. A remote attacker could exploit this to read certain areas of memory, possibly gaining access to sensitive information. This issue affects Ubuntu 8.04 LTS, and an updated fix is included for Ubuntu 6.06 LTS, 7.04 and 7.10. (CVE-2007-5898)

It was discovered that the output_add_rewrite_var function would sometimes leak session id information to forms targeting remote URLs.
Malicious remote sites could use this information to gain access to a PHP application user's login credentials. This issue only affects Ubuntu 8.04 LTS. (CVE-2007-5899)

It was discovered that PHP did not properly calculate the length of PATH_TRANSLATED. If a PHP application were tricked into processing a malicious URI, and attacker may be able to execute arbitrary code with application privileges. (CVE-2008-0599)

An integer overflow was discovered in the php_sprintf_appendstring function. Attackers could exploit this to cause a denial of service.
(CVE-2008-1384)

Andrei Nigmatulin discovered stack-based overflows in the FastCGI SAPI of PHP. An attacker may be able to leverage this issue to perform attacks against PHP applications. (CVE-2008-2050)

It was discovered that the escapeshellcmd did not properly process multibyte characters. An attacker may be able to bypass quoting restrictions and possibly execute arbitrary code with application privileges. (CVE-2008-2051)

It was discovered that the GENERATE_SEED macro produced a predictable seed under certain circumstances. Attackers may by able to easily predict the results of the rand and mt_rand functions. (CVE-2008-2107, CVE-2008-2108)

Tavis Ormandy discovered that the PCRE library did not correctly handle certain in-pattern options. An attacker could cause PHP applications using pcre to crash, leading to a denial of service.
USN-624-1 fixed vulnerabilities in the pcre3 library. This update provides the corresponding update for PHP. (CVE-2008-2371)

It was discovered that php_imap used obsolete API calls. If a PHP application were tricked into processing a malicious IMAP request, an attacker could cause a denial of service or possibly execute code with application privileges. (CVE-2008-2829).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability in PHP allowed context-dependent attackers to cause a denial of service (crash) via a certain long string in the glob() or fnmatch() functions (CVE-2007-4782).

A vulnerability in the cURL library in PHP allowed context-dependent attackers to bypass safe_mode and open_basedir restrictions and read arbitrary files using a special URL request (CVE-2007-4850).

An integer overflow in PHP allowed context-dependent attackers to cause a denial of serivce via a special printf() format parameter (CVE-2008-1384).

A stack-based buffer overflow in the FastCGI SAPI in PHP has unknown impact and attack vectors (CVE-2008-2050).

A buffer overflow in the imageloadfont() function in PHP allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via a crafted font file (CVE-2008-3658).

A buffer overflow in the memnstr() function allowed context-dependent attackers to cause a denial of service (crash) and potentially execute arbitrary code via the delimiter argument to the explode() function (CVE-2008-3659).

PHP, when used as a FastCGI module, allowed remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension (CVE-2008-3660).

An array index error in the imageRotate() function in PHP allowed context-dependent attackers to read the contents of arbitrary memory locations via a crafted value of the third argument to the function for an indexed image (CVE-2008-5498).

The updated packages have been patched to correct these issues.

バナーによると、リモートホストにインストールされている PHP のバージョンは 5.2.6 より前です。このようなバージョンは、以下の問題の影響を受けることがあります。

  - FastCGI SAPI でのスタックベースのバッファオーバーフロー。

  - printf() での整数オーバーフロー。

  - cgi_main.c での PATH_TRANSLATED の長さの不適切な計算によるセキュリティ問題。

  - cURL での safe_mode バイパス。

  - escapeshellcmd() 内のマルチバイト char の不完全な取り扱い。

  - バージョン 7.6 によって修正されたバンドル PCRE での問題。

バナーによると、リモートホストにインストールされている PHP のバージョンは 4.4.9 より前です。このようなバージョンは、以下の複数のセキュリティ問題の影響を受けることがあります。

  - バージョン 7.7 によって修正済みのバンドルされた PCRE ライブラリに、未特定の問題があります。

  - 「ext/gd/gd.c」の「imageloadfont()」関数のバッファオーバーフローは、特別に作り上げられたフォントが与えられたときにトリガできます。（CVE-2008-3658）

  - 内部「memnstr()」関数にバッファオーバーフローがあり、「explode()」としてユーザースペースに漏洩されます。
    （CVE-2008-3659）

  - ファイル名に 2 つのドットが含まれているとき、サービス拒否の脆弱性があります。（CVE-2008-3660）

  - curl 拡張での「open_basedir」処理の問題。

  -  「.htaccess」で設定された「mbstring.func_overload」は、グローバルになります。（CVE-2009-0754）

リリースアナウンスが、これは PHP 4.4 シリーズの最後のリリースであると述べていることに、注意してください。

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.6。這些版本可能受到以下問題影響：

  - FastCGI SAPI 中的堆疊型緩衝區溢位。

  - printf() 中的整數溢位。

  - 因 cgi_main.c PATH_TRANSLATED 長度計算不當而產生的安全性問題。

  - cURL 中的 safe_mode 繞過。

  - escapeshellcmd() 內的多位元組字元處理不完全。

  - 版本 7.6 修復的搭配 PCRE 中的問題。

根據其標題，遠端主機上安裝的 PHP 版本舊於 4.4.9。這些版本可能會受到多個安全性問題影響：

  - 版本 7.7 修復的搭配 PCRE 中，存有不明問題。

  - 指定特製字型時，可能會觸發 'ext/gd/gd.c' 之 'imageloadfont()' 函式中的緩衝區溢位。(CVE-2008-3658)

  - 內部 'memnstr()' 函式中存有緩衝區溢位問題，其會顯示在 'explode()' 的使用者空間中。
    (CVE-2008-3659)

  - 檔案名稱包含 2 個點時，存有拒絕服務弱點。(CVE-2008-3660)

  - Curl 延伸模組中存有 'open_basedir' 處理問題。

  - '.htaccess' 中設定的 'mbstring.func_overload' 集變為全域。(CVE-2009-0754)

請注意，版本公告聲明，此將會是 PHP 4.4 系列的最後版本。

根据其标题，远程主机上安装的 PHP 版本早于 5.2.6。此类版本可能会受到以下问题的影响：

  - FastCGI SAPI 中基于堆栈的缓冲区溢出。

  - printf() 中的整数溢出。

  - cgi_main.c 中 PATH_TRANSLATED 长度的不当计算引起的安全问题。

  - cURL 中的 safe_mode 绕过。

  - escapeshellcmd() 内部多字节字符的不完全处理。

  - 由 7.6 版修复的捆绑式 PCRE 中的问题。

根据其标题，远程主机上安装的 PHP 版本早于 4.4.9。此类版本可能会受到多个安全问题的影响：

  - 由 7.7 版修复的捆绑式 PCRE 中不明的问题。

  -“ext/gd/gd.c”的“imageloadfont()”函数中存在缓冲区溢出，当提供特别构建的字体时，可触发此漏洞。(CVE-2008-3658)

  - 内部“memnstr()”函数中存在缓冲区溢出，可导致信息以“explode()”形式暴露在用户空间。
    (CVE-2008-3659)

  - 文件名包含两个点时存在拒绝服务漏洞。(CVE-2008-3660)

  - curl 扩展中存在“open_basedir”处理问题。

  -“.htaccess”中设置的“mbstring.func_overload”变为全局值。(CVE-2009-0754)

请注意，版本声明陈述这将是 PHP 4.4 系列的最后一个版本。

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-005 applied. 

This update contains security fixes for a number of programs.

According to its banner, the version of PHP installed on the remote host is older than 4.4.9.  Such versions may be affected by several security issues :

  - There are unspecified issues in the bundled PCRE library     fixed by version 7.7.

  - A buffer overflow in the 'imageloadfont()' function in     'ext/gd/gd.c' can be triggered when a specially crafted     font is given. (CVE-2008-3658)

  - A buffer overflow exists in the internal 'memnstr()'     function, which is exposed to userspace as 'explode()'.
    (CVE-2008-3659)

  - A denial of service vulnerability exists when a     filename contains 2 dots. (CVE-2008-3660)

  - An 'open_basedir' handling issue in the curl extension.

  - 'mbstring.func_overload' set in '.htaccess' becomes     global. (CVE-2009-0754)

Note that the release announcement states this will be the last release for the PHP 4.4 series.

According to its banner, the version of PHP installed on the remote host is older than 5.2.6.  Such versions may be affected by the following issues :

  - A stack-based buffer overflow in FastCGI SAPI.

  - An integer overflow in printf().

  - An security issue arising from improper calculation     of the length of PATH_TRANSLATED in cgi_main.c.

  - A safe_mode bypass in cURL.

  - Incomplete handling of multibyte chars inside     escapeshellcmd().

  - Issues in the bundled PCRE fixed by version 7.6.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-007 applied. 

This security update contains fixes for the following products :

  - Apache
  - Certificates
  - ClamAV
  - ColorSync
  - CUPS
  - Finder
  - launchd
  - libxslt
  - MySQL Server
  - Networking
  - PHP
  - Postfix
  - PSNormalizer
  - QuickLook
  - rlogin
  - Script Editor
  - Single Sign-On
  - Tomcat
  - vim
  - Weblog

According to its banner, the version of PHP 4.x installed on the remote host is older than 4.4.9.  Such versions address several security issues, including : 

  - An update of PCRE to version 7.7.
  - An overflow in memnstr().
  - A crash in imageloadfont when an invalid font is given.
  - An open_basedir handling issue in the curl extension.
  - 'mbstring.func_overload' set in '.htaccess' becomes global.  Note that the release announcement states this will be the last release for the PHP 4.4 series.  

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.2.6.  Such versions may be affected by the following issues :

  - A stack buffer overflow in FastCGI SAPI.
  - An integer overflow in printf().
  - An unspecified security issue tracked by CVE-2008-0599.
  - A safe_mode bypass in cURL.
  - Incomplete handling of multibyte chars inside escapeshellcmd().
  - Issues in the bundled PCRE fixed by version 7.6.

According to its banner, the version of PHP installed on the remote host is older than 4.4.9.  Such versions address several security issues, including : 

  - An update of PCRE to version 7.7.
  - An overflow in memnstr().
  - A crash in imageloadfont when an invalid font is given.
  - An open_basedir handling issue in the curl extension.
  - 'mbstring.func_overload' set in '.htaccess' becomes global.  Note that the release announcement states this will be the last release for the PHP 4.4 series.

The version of PHP installed on the remote host is older than 5.2.6.  Such versions may be affected by the following issues :

  - A stack buffer overflow in FastCGI SAPI.
  - An integer overflow in printf().
  - An unspecified security issue tracked by CVE-2008-0599.
  - A safe_mode bypass in cURL.
  - Incomplete handling of multibyte chars inside escapeshellcmd().
  - Issues in the bundled PCRE fixed by version 7.6.

ID	名稱	產品	系列	已發布	已更新	嚴重性
33575	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : php5 vulnerabilities (USN-628-1)	Nessus	Ubuntu Local Security Checks	2008/7/24	2021/1/19	critical
36294	Mandriva Linux Security Advisory : php (MDVSA-2009:022)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	critical
32123	PHP < 5.2.6 の複数の脆弱性	Nessus	CGI abuses	2008/5/2	2024/5/31	high
33849	PHP < 4.4.9 の複数の脆弱性	Nessus	CGI abuses	2008/8/8	2024/5/31	high
32123	PHP < 5.2.6 多種弱點	Nessus	CGI abuses	2008/5/2	2024/5/31	high
33849	PHP < 4.4.9 多種弱點	Nessus	CGI abuses	2008/8/8	2024/5/31	high
32123	PHP < 5.2.6 多种漏洞	Nessus	CGI abuses	2008/5/2	2024/5/31	high
33849	PHP < 4.4.9 多种漏洞	Nessus	CGI abuses	2008/8/8	2024/5/31	high
33790	Mac OS X Multiple Vulnerabilities (Security Update 2008-005)	Nessus	MacOS X Local Security Checks	2008/8/1	2024/5/28	critical
33849	PHP < 4.4.9 Multiple Vulnerabilities	Nessus	CGI abuses	2008/8/8	2024/5/31	high
32123	PHP < 5.2.6 Multiple Vulnerabilities	Nessus	CGI abuses	2008/5/2	2024/5/31	high
34374	Mac OS X Multiple Vulnerabilities (Security Update 2008-007)	Nessus	MacOS X Local Security Checks	2008/10/10	2024/5/28	critical
4620	PHP 4.x < 4.4.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2008/8/11	2019/3/6	high
4493	PHP 5.x < 5.2.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2008/5/2	2019/3/6	high
801083	PHP < 4.4.9 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high
801068	PHP < 5.2.6 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

偵測

搜尋 Plugin

critical

critical

high

high

high

high

high

high

critical

high

high

critical

high

high

high

high