根據其自我報告的版本號碼，遠端 pfSense 安裝版本比 2.2.4 舊。因此受到多個弱點影響，如提及的供應商公告中所述。

據發現，PHP Zip 延伸模組會在處理特定 zip 檔案時錯誤地處理目錄。遠端攻擊者可能利用此問題建立任意目錄。
(CVE-2014-9767)

據發現，PHP Soap 用戶端會錯誤驗證資料類型。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。
(CVE-2015-8835、CVE-2016-3185)

據發現，PHP MySQL 原生驅動程式會錯誤處理 TLS 與 MySQL 資料庫的連線。攔截式攻擊者可能利用此問題，在 TLS 連線上進行降級或窺探。
此弱點稱為 BACKRONYM。(CVE-2015-8838)

據發現，PHP 未正確處理 imagerotate 函式。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務或可能取得敏感資訊。此問題僅適用於 Ubuntu 14.04 LTS 和 Ubuntu 15.10。(CVE-2016-1903)

Hans Jerry Illikainen 發現 PHP phar 延伸模組未正確處理特定 tar 封存。遠端攻擊者可利用此問題造成 PHP 損毀，進而造成拒絕服務或可能執行任意程式碼。(CVE-2016-2554)

據發現，PHP WDDX 延伸模組未正確處理某些格式錯誤的 XML 資料。遠端攻擊者可能利用此問題造成 PHP 損毀，進而造成拒絕服務或可能執行任意程式碼。(CVE-2016-3141)

據發現，PHP phar 延伸模組未正確處理特定 zip 檔案。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務或可能取得敏感資訊。(CVE-2016-3142)

據發現，PHP libxml_disable_entity_loader() 設定會在執行緒之間分享。在 PHP-FPM 之下執行時，這可導致 XML 外部實體插入和實體擴充問題。
此問題僅適用 Ubuntu 12.04 LTS 和 Ubuntu 14.04 LTS。(無 CVE 編號)

據發現，PHP openssl_random_pseudo_bytes() 函式未傳回以密碼編譯方式強化的 pseudo-random 位元組。(無 CVE 編號)

據發現，PHP Fileinfo 元件並未正確處理特定 magic 檔案。攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務，或可能執行任意程式碼。(CVE 編號擱置)

據發現，PHP php_snmp_error() 函式未正確處理字串格式設定。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。此問題僅適用於 Ubuntu 14.04 LTS 和 Ubuntu 15.10。(CVE 編號擱置)

據發現，PHP rawurlencode() 函式未正確處理大型字串。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務。(CVE 編號擱置)

據發現，PHP phar 延伸模組未正確處理封存中的特定檔案名稱。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。(CVE 編號擱置)

據發現，PHP mb_strcut() 函式未正確處理字串格式設定。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。(CVE 編號擱置)。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

USN-2952-1 已修正 PHP 中的弱點。其中一個反向移植的修補程式在 PHP Soap 用戶端中造成迴歸。此更新可修正該問題。

由此給您帶來的不便，我們深表歉意。

據發現，PHP Zip 延伸模組會在處理特定 zip 檔案時錯誤地處理目錄。遠端攻擊者可能利用此問題建立任意目錄。
(CVE-2014-9767)

據發現，PHP Soap 用戶端會錯誤驗證資料類型。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。(CVE-2015-8835、CVE-2016-3185)

據發現，PHP MySQL 原生驅動程式會錯誤處理 TLS 與 MySQL 資料庫的連線。攔截式攻擊者可能利用此問題，在 TLS 連線上進行降級或窺探。此弱點稱為 BACKRONYM。(CVE-2015-8838)

據發現，PHP 未正確處理 imagerotate 函式。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務或可能取得敏感資訊。此問題僅適用於 Ubuntu 14.04 LTS 和 Ubuntu 15.10。
(CVE-2016-1903)

Hans Jerry Illikainen 發現 PHP phar 延伸模組未正確處理特定 tar 封存。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。
(CVE-2016-2554)

據發現，PHP WDDX 延伸模組未正確處理某些格式錯誤的 XML 資料。遠端攻擊者可能利用此問題造成 PHP 損毀，進而造成拒絕服務或可能執行任意程式碼。
(CVE-2016-3141)

據發現，PHP phar 延伸模組未正確處理特定 zip 檔案。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務或可能取得敏感資訊。
(CVE-2016-3142)

據發現，PHP libxml_disable_entity_loader() 設定會在執行緒之間分享。在 PHP-FPM 之下執行時，這可導致 XML 外部實體插入和實體擴充問題。
此問題僅適用 Ubuntu 12.04 LTS 和 Ubuntu 14.04 LTS。(無 CVE 編號)

據發現，PHP openssl_random_pseudo_bytes() 函式未傳回以密碼編譯方式強化的 pseudo-random 位元組。(無 CVE 編號)

據發現，PHP Fileinfo 元件並未正確處理特定 magic 檔案。攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務，或可能執行任意程式碼。(CVE 編號擱置)

據發現，PHP php_snmp_error() 函式未正確處理字串格式設定。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。此問題僅適用於 Ubuntu 14.04 LTS 和 Ubuntu 15.10。
(CVE 編號擱置)

據發現，PHP rawurlencode() 函式未正確處理大型字串。遠端攻擊者可利用此問題造成 PHP 損毀，進而導致拒絕服務。(CVE 編號擱置)

據發現，PHP phar 延伸模組未正確處理封存中的特定檔案名稱。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。(CVE 編號擱置)

據發現，PHP mb_strcut() 函式未正確處理字串格式設定。遠端攻擊者可利用此問題造成 PHP 損毀，進而引發拒絕服務或可能執行任意程式碼。(CVE 編號擱置)。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Versions of PHP 5.5.x earlier than 5.5.27, or 5.6.x earlier than 5.6.11 are vulnerable to the following issues :

 A double-free flaw exists in zend_vm_execute.h due to improper handling of certain code. An attacker can exploit this flaw to crash a PHP application, resulting in a denial of service condition.
 - A flaw exists in the parse_ini_file() and parse_ini_string() functions. Due to improper handling of strings that contain a line feed followed by an escape character, an attacker can exploit this to crash a PHP application, resulting in a denial of service condition.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.11. It is, therefore, affected by multiple vulnerabilities.
 - A security feature bypass vulnerability, known as 'BACKRONYM', exists due to a failure to properly enforce the requirement of an SSL/TLS connection when the --ssl client option is used. A man-in-the-middle attacker can exploit this flaw to coerce the client to downgrade to an unencrypted connection, allowing the attacker to disclose data from the database or manipulate database queries. (CVE-2015-3152)
 - A flaw in the phar_convert_to_other function in ext/phar/phar_object.c could allow a remote attacker to cause a denial of service. (CVE-2015-5589)
 - A Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c could allow a remote attacker to cause a denial of service. (CVE-2015-5590)
 - A flaw exists in the PHP Connector/C component due to a failure to properly enforce the requirement of an SSL/TLS connection when the --ssl client option is used.
 - A man-in-the-middle attacker can exploit this to downgrade the connection to plain HTTP when HTTPS is expected. (CVE-2015-8838)
 - A use-after-free error exists in the spl_recursive_it_move_forward_ex() function. An attacker can exploit this to dereference already freed memory, potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the sqlite3SafetyCheckSickOrOk() function. An attacker can exploit this to dereference already freed memory, potentially allowing the execution of arbitrary code.
 - The '!' character is not treated as a special character when delayed variable substitution is enabled. The functions escapeshellcmd() and escapeshellarg() are unable to properly sanitize arguments containing '!'.
 - An attacker can exploit this to execute arbitrary commands.
 - A double-free flaw exists in zend_vm_execute.h due to improper handling of certain code. An attacker can exploit this flaw to crash a PHP application, resulting in a denial of service condition.

Versions of PHP 5.5.x prior to 5.5.37, or 5.6.x prior to 5.6.23, or 7.0.x prior to 7.0.8 are vulnerable to the following issues :

 - PHP 'ext/mysqlnd/mysqlnd.c' contains a flaw that is due to the program failing to properly enforce the requirement of an SSL/TLS connection when the '--ssl client' option is used. This may allow a MitM (Man-in-the-Middle) attacker to downgrade the connection to plain HTTP when expected to be HTTPS. (CVE-2015-8838)
 - An integer overflow condition exists in the 'getFromIndex()'' and 'getFromName()' methods of 'ZipArchive'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted ZIP file. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3078)
 - An XXE (Xml eXternal Entity) injection and expansion flaw affects the 'libxml_disable_entity_loader()' function in the source file 'ext/libxml/libxml.c' in PHP-FPM that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to sensitive information or cause a denial of service. (CVE-2015-8866)
 - An integer overflow condition exists in the 'php_filter_encode_url()' function in 'ext/filter/sanitizing_filters.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4345)
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4346)
 - The program contains an out-of-bounds read flaw in 'ext/intl/grapheme/grapheme_string.c' that is triggered when handling negative offsets in 'zif_grapheme_stripos'. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4540, CVE-2016-4541)
 - An out-of-bounds read flaw exists in the 'php_str2num()' function in 'ext/bcmath/bcmath.c' that is triggered when accepting negative scales. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4537, CVE-2016-4538)
 - An out-of-bounds read flaw exists in the 'exif_read_data()' function in 'ext/exif/exif.c' that is triggered when handling exif headers. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
 - A flaw in the 'xml_parse_into_struct()' function in 'ext/xml/xml.c' is triggered during the handling of a specially crafted XML content. This may allow a remote attacker to cause a denial of service. (CVE-2016-4539)
 - A double-free flaw exists in the 'php_formatted_print()' function in 'ext/standard/formatted_print.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-8880)
 - A flaw exists in 'main/php_open_temporary_file.c' that is triggered as thread safety is not ensured during the handling of temporary directories. This may allow a remote attacker to cause a denial of service. (CVE-2015-8878)
 - An integer overflow flaw exists in the 'php_html_entities()' and 'php_filter_full_special_chars()' functions in 'ext/standard/html.c' that is triggered as input is not properly validated. This may allow a remote attacker to have an unspecified impact. No further details have been provided. (CVE-2016-5094, CVE-2016-5095)
 - An integer underflow issue exists in 'ext/standard/file.c' that is triggered as input is not properly validated. This may allow a remote attacker to cause a NULL write and cause a process linked against PHP to crash. (CVE-2016-5096)
 - An out-of-bounds read flaw exists in the '_gdContributionsCalc()' function in 'ext/gd/libgd/gd_interpolation.c'. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2013-7456)
 - An out-of-bounds read flaw exists in the 'get_icu_value_internal()' function within 'ext/intl/locale/locale_methods.c' that is triggered when handling user-supplied input. This may allow a remote attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-5093)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'header()' function does not filter input passed via HTTP headers before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8935)
 - A use-after-free error exists in the garbage collection algorithm in 'ext/zip/php_zip.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5773)
 - An integer overflow condition exists in the 'json_decode()' and 'json_utf8_to_utf16()' functions in 'ext/standard/php_smart_str.h'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.
 - An out-of-bounds read flaw exists within the 'pass2_no_dither()' function inside 'ext/gd/libgd/gd_topal.c' that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw exists within the '_php_mb_regex_ereg_replace_exec()' function inside 'ext/mbstring/php_mbregex.c' that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)
 - An integer overflow condition exists in 'ext/spl/spl_directory.c'. The issue is triggered by an 'int/size_t' confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)
 - An integer overflow condition exists in 'ext/mcrypt/mcrypt.c'. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)
 - An integer overflow condition exists within the 'nl2br()' function inside 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.
 - An integer overflow condition exists within multiple functions in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw within the 'php_wddx_process_data()' function inside 'ext/wddx/wddx.c' that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)
 - An integer overflow condition exists witin the 'gdImagePaletteToTrueColor()' function inside 'ext/gd/libgd/gd.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)
 - An invalid free flaw exists within the 'phar_extract_file()' function inside 'ext/phar/phar_object.c'. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)
 - An integer overflow condition exists within the '_gd2GetHeader()' function inside 'ext/gd/libgd/gd_gd2.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)
 - A use-after-free error exists within the garbage collection algorithm inside 'ext/spl/spl_array.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5771)

ID	名稱	產品	系列	已發布	已更新	嚴重性
106496	pfSense < 2.2.4 多個弱點 (SA-15_07)	Nessus	Firewalls	2018/1/31	2019/11/8	medium
90677	Ubuntu 14.04 LTS：PHP 弱點 (USN-2952-1)	Nessus	Ubuntu Local Security Checks	2016/4/22	2024/8/27	critical
90825	Ubuntu 15.10：php5 迴歸 (USN-2952-2)	Nessus	Ubuntu Local Security Checks	2016/5/2	2023/1/12	critical
8955	PHP 5.5.x < 5.5.27 / 5.6.x < 5.6.11 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2015/10/7	2019/3/6	high
8954	PHP 5.6.10 < 5.6.11 Multiple Vulnerabilities (BACKRONYM)	Nessus Network Monitor	Web Servers	2015/10/7	2019/3/6	high
9393	PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/7/13	2019/3/6	high

偵測

搜尋 Plugin

medium

critical

critical

high

high

high