Buffer overflow in the gdImageStringFTEx function in gdft.c in the GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

Libwmf uses an embedded copy of the gd source and may also be affected by this issue.

Packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gd: additional overflows (CVE-2004-0941)

  - libwmf: Memory allocation failure in wmf_malloc (CVE-2016-9011)

  - Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier     allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary     code via a crafted string with a JIS encoded font. (CVE-2007-0455)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote BIG-IP device is missing a patch required by a security advisory.

Updated PHP packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A flaw was found in the way the mbstring extension set global variables. A script which used the mb_parse_str() function to set global variables could be forced to enable the register_globals configuration option, possibly resulting in global variable injection.
(CVE-2007-1583)

A heap based buffer overflow flaw was discovered in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution.
(CVE-2007-1001)

A buffer over-read flaw was discovered in PHP's gd extension. A script that could be forced to write arbitrary string using a JIS font from an untrusted source could cause the PHP interpreter to crash.
(CVE-2007-0455)

A flaw was discovered in the way PHP's mail() function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients. (CVE-2007-1718)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.

New libwmf packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of PHP lower than 4.4.7 or 5.2.2.  This version is vulnerable to a number of remote issues.  At least one of these issues is related to a buffer overflow attack.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
24649	Mandrake Linux Security Advisory : libwmf (MDKSA-2007:036)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	high
198368	RHEL 6 : libwmf (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
78215	F5 Networks BIG-IP : Multiple PHP vulnerabilities (SOL7859)	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/1/11	high
25325	RHEL 5 : php (RHSA-2007:0153)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	high
109432	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : libwmf (SSA:2018-120-01)	Nessus	Slackware Local Security Checks	2018/5/1	2024/10/16	high
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	2011/1/5	2021/1/11	high
3982	PHP 4.x < 4.4.7 / 5.x < 5.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/5/4	2019/3/6	high
801085	PHP < 4.4.7 / 5.2.2 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

偵測

搜尋 Plugin

high

medium

high

high

high

high

high

high