PHP は、複数のセキュリティ問題を修正するバージョン 5.3.3 に更新されています。

（CVE-2010-0397、CVE-2010-1860、CVE-2010-1862、CVE-2010-1864、 CVE-2010-1866、CVE-2010-1914、CVE-2010-1915、CVE-2010-1917、 CVE-2010-2093、CVE-2010-2094、CVE-2010-2097、CVE-2010-2100、 CVE-2010-2101、CVE-2010-2190、CVE-2010-2191、CVE-2010-2225、 CVE-2010-2531、CVE-2010-2950、CVE-2010-3062、CVE-2010-3063、 CVE-2010-3064、CVE-2010-3065）

PHP was updated to version 5.3.3 to fix serveral security issues.

(CVE-2010-0397, CVE-2010-1860, CVE-2010-1862, CVE-2010-1864, CVE-2010-1866, CVE-2010-1914, CVE-2010-1915, CVE-2010-1917, CVE-2010-2093, CVE-2010-2094, CVE-2010-2097, CVE-2010-2100, CVE-2010-2101, CVE-2010-2190, CVE-2010-2191, CVE-2010-2225, CVE-2010-2531, CVE-2010-2950, CVE-2010-3062, CVE-2010-3063, CVE-2010-3064, CVE-2010-3065)

An input validation flaw was discovered in the PHP session serializer.
If a PHP script generated session variable names from untrusted user input, a remote attacker could use this flaw to inject an arbitrary variable into the PHP session. (CVE-2010-3065)

An information leak flaw was discovered in the PHP var_export() function implementation. If some fatal error occurred during the execution of this function (such as the exhaustion of memory or script execution time limit), part of the function's output was sent to the user as script output, possibly leading to the disclosure of sensitive information. (CVE-2010-2531)

A numeric truncation error and an input validation flaw were found in the way the PHP utf8_decode() function decoded partial multi-byte sequences for some multi-byte encodings, sending them to output without them being escaped. An attacker could use these flaws to perform a cross-site scripting attack. (CVE-2009-5016, CVE-2010-3870)

It was discovered that the PHP lcg_value() function used insufficient entropy to seed the pseudo-random number generator. A remote attacker could possibly use this flaw to predict values returned by the function, which are used to generate session identifiers by default.
This update changes the function's implementation to use more entropy during seeding. (CVE-2010-1128)

It was discovered that the PHP fnmatch() function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch() on untrusted matching patterns. (CVE-2010-1917)

A NULL pointer dereference flaw was discovered in the PHP XML-RPC extension. A malicious XML-RPC client or server could use this flaw to crash the PHP interpreter via a specially crafted XML-RPC request.
(CVE-2010-0397)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-007 applied. 

This security update contains fixes for the following products :

  - AFP Server
  - Apache mod_perl
  - ATS
  - CFNetwork
  - CoreGraphics
  - CoreText
  - CUPS
  - Directory Services
  - diskdev_cmds
  - Disk Images
  - Flash Player plug-in
  - gzip
  - ImageIO
  - Image RAW
  - MySQL
  - Password Server
  - PHP
  - Printing
  - python
  - QuickLook
  - Safari RSS
  - Wiki Server
  - X11

Several vulnerabilities were discovered in PHP, which could lead to denial of service or potentially the execution of arbitrary code.

  - CVE-2010-2531     An information leak was found in the var_export()     function.

  - CVE-2011-0421     The Zip module could crash.

  - CVE-2011-0708     An integer overflow was discovered in the Exif module.

  - CVE-2011-1466     An integer overflow was discovered in the Calendar     module.

  - CVE-2011-1471     The Zip module was prone to denial of service through     malformed archives.

  - CVE-2011-2202     Path names in form based file uploads (RFC 1867) were     incorrectly validated.

This update also fixes two bugs, which are not treated as security issues, but fixed nonetheless, see README.Debian.security for details on the scope of security support for PHP (CVE-2011-0420, CVE-2011-1153 ).

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 6.3.  Such versions are reportedly affected by the following vulnerabilities :

  - An error exists in the function 'fnmatch' in the     bundled version of PHP that can lead to stack     exhaustion. (CVE-2010-1917)

  - An information disclosure vulnerability exists in the     'var_export' function in the bundled version of PHP     that can be triggered when handling certain error     conditions. (CVE-2010-2531)

  - A double free vulnerability in the     'ssl3_get_key_exchange()' function in the third-party     OpenSSL library could be abused to crash the     application. (CVE-2010-2939)

  - A format string vulnerability in the phar extension     in the bundled version of PHP could lead to the     disclosure of memory contents and possibly allow     execution of arbitrary code via a specially crafted     'phar://' URI. (CVE-2010-2950)

  - A NULL pointer dereference in     'ZipArchive::getArchiveComment' included with the     bundled version of PHP can be abused to crash the     application. (CVE-2010-3709)

  - The bundled version of libxml2 may read from invalid     memory locations when processing malformed XPath     expressions, resulting in an application crash.
    (CVE-2010-4008)

  - An error in the 'mb_strcut()' function in the bundled     version of PHP can be exploited by passing a large     'length' parameter to disclose potentially sensitive     information from the heap. (CVE-2010-4156)

  - An as-yet unspecified remote code execution     vulnerability could allow an authenticated user to     execute arbitrary code with system privileges.
    (CVE-2011-1540)

  - An as-yet unspecified, unauthorized access vulnerability     could lead to a complete system compromise.
    (CVE-2011-1541)

Versions of Mac OS X 10.6 earlier than 10.6.5 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.5 contains security fixes for the following products :

  - AFP Server

  - Apache mod_perl

  - Apache

  - AppKit

  - ATS

  - CFNetwork

  - CoreGraphics

  - CoreText

  - CUPS

  - Directory Services

  - diskdev_cmds

Disk Images

  - Flash Player plug-in

  - gzip

  - Image Capture

  - ImageIO

  - Image RAW

  - Kernel

  - MySQL

  - neon

  - Networking

  - OpenLDAP

  - OpenSSL

  - Password Server

  - PHP

  - Printing

  - python

  - QuickLook

  - QuickTime

  - Safari RSS

  - Time Machine

  - Wiki Server

  - X11

  - xar

Versions of PHP prior to 5.2.14, or 5.3.x prior to 5.3.3 are affected by the following vulnerabilities :

 - An information disclosure vulnerability in 'var_export()' when a fatal error occurs.
 - A resource destruction issue in 'shm_put_var()'.
 - A possible information leak because of an interruption of XOR operator.
 - A memory corruption issue caused by an unexpected call-time pass by reference and the following memory clobbering through callbacks.
 - A memory corruption issue in 'ArrayObject::uasort()'.
 - A memory corruption issue in 'parse_str()'.
 - A memory corruption issue in 'pack()'.
 - A memory corruption issue in 'substr_replace()'.
 - A memory corruption issue in 'addcslashes()'.
 - A stack exhaustion issue in 'fnmatch()'.
 - A buffer overflow vulnerability in the dechunking filter.
 - An arbitrary memory access issue in the sqlite extension.
 - A string format validation issue in the phar extension.
 - An unspecified issue relating to the handling of session variable serialization on certain prefix characters.
 - A NULL pointer dereference issue when processing invalid XML-RPC requests.
 - An unserialization issue in 'SplObjectStorage'.
 - Buffer overflow vulnerabilities in 'mysqlnd_list_fields' and 'mysqlnd_change_user'.
 - Buffer overflows when handling error packets in mysqlnd.
 - A flaw affects 'sqlite_single_query()' and 'sqlite_array_query()' methods included in the 'ext/sqlite/sqlite.c' source file. Specifically, the 'rres' resource is not properly initialized before use which may trigger a double-free condition when an empty query is passed to the 'real_result_dtor()' function.

According to its banner the version of PHP installed on the remote host is earlier than 5.3.3 / 5.2.14.  Such version are potentially affected by multiple vulnerabilities :

  - An information disclosure vulnerability in var_export() when a fatal error occurs.

  - A resource destruction issue in shm_put_var().

  - A possible information leak because of an interruption of XOR operator.

  - A memory corruption issue caused by an unexpected call-time pass by reference and the following memory clobbering through callbacks.

  - A memory corruption issue in ArrayObject::uasort().

  - A memory corruption issue in parse_str().

  - A memory corruption issue in pack().

  - A memory corruption issue in substr_replace().

  - A memory corruption issue in addcslashes().

  - A stack exhaustion issue in fnmatch().

  - A buffer overflow vulnerability in the dechunking filter.

  - An arbitrary memory access issue in the sqlite extension.

  - A string format validation issue in the phar extension.

  - An unspecified issue relating to the handling of session variable serialization on certain prefix characters.

  - A NULL pointer dereference issue when processing invalid XML-RPC requests.

  - An unserialization issue in SplObjectStorage.

  - Buffer overflow vulnerabilities in mysqlnd_list_fields and mysqlnd_change_user.

  - Buffer overflows when handling error packets in mysqlnd.

ID	名稱	產品	系列	已發布	已更新	嚴重性
75429	openSUSE セキュリティ更新：apache2-mod_php5 （openSUSE-SU-2010:0599-1）	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
75429	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
49210	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2010:0599-1)	Nessus	SuSE Local Security Checks	2010/9/13	2021/1/14	high
60908	Scientific Linux Security Update : php on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium
50549	Mac OS X Multiple Vulnerabilities (Security Update 2010-007)	Nessus	MacOS X Local Security Checks	2010/11/10	2024/5/28	critical
55486	Debian DSA-2266-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	2011/7/5	2021/1/4	high
53532	HP System Management Homepage < 6.3 Multiple Vulnerabilities	Nessus	Web Servers	2011/4/22	2022/4/11	critical
5705	Mac OS X 10.6 < 10.6.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	2010/11/11	2019/3/6	critical
5616	PHP < 5.2.14 / 5.3.x < 5.3.3 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2010/7/27	2019/3/6	high
801070	PHP < 5.3.3 / 5.2.14 Multiple Vulnerabilities	Log Correlation Engine	Web Servers	2010/7/27		high

偵測

搜尋 Plugin

high

high

high

medium

critical

high

critical

critical

high

high