此 php5 更新修复以下安全问题：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻击 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到类型混淆问题影响，可导致崩溃 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的空指针取消引用可导致崩溃。[bsc#968284] 注意：我们当前没有随附 phar 扩展，因此我们不会受到影响。

- CVE-2016-3141：WDDX 反序列化中的释放后使用/双重释放可导致崩溃或可能执行代码。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的越界读取可导致崩溃。[bsc#971912] 注意：我们当前没有随附 phar 扩展，因此我们不会受到影响。

- CVE-2014-9767：已修复解压缩 zip 文件时发生的目录遍历问题，其可导致覆盖文件。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的类型混淆漏洞可导致崩溃或可能执行代码。[bsc#971611]

此更新从 SUSE:SLE-12:Update 更新项目导入。

远程主机运行的 Mac OS X 版本为低于比 10.11.5 的 10.11.x。因此，它受到以下组件中的多种漏洞影响：

- AMD
 - apache_mod_php
 - AppleGraphicsControl
 - AppleGraphicsPowerManagement
 - Assistant
 - ATS
 - Audio
 - Captive
 - CFNetwork
 - CommonCrypto
 - CoreCapture
 - CoreStorage
 - Crash
 - Disk
 - Disk
 - Driver
 - Drivers
 - Drivers
 - Graphics
 - Graphics
 - Graphics
 - ImageIO
 - Images
 - Intel
 - IOAcceleratorFamily
 - IOAudioFamily
 - IOFireWireFamily
 - IOHIDFamily
 - Kernel
 - libc
 - libxml2
 - libxslt
 - Lock
 - MapKit
 - Messages
 - Multi-Touch
 - Network
 - NVIDIA
 - OpenGL
 - Proxies
 - QuickTime
 - Reporter
 - SceneKit
 - Screen
 - Tcl
 - Utility

请注意，如果成功利用最严重的问题则可能导致执行任意代码。

此 php53 更新修复了以下问题：

- CVE-2016-5093：一个 get_icu_value_internal 越界读取可能会导致 php 解释器崩溃 (bsc#982010)

- CVE-2016-5094、CVE-2016-5095：不允许创建长度超出 int 范围的字符串，以避免溢出 (bsc#982011、bsc#982012)

- CVE-2016-5096：fread 中的一个 int/size_t 混淆可能造成损坏内存 (bsc#982013)

- CVE-2016-5114：fpm_log.c 内存泄漏和缓冲区溢出可能导致信息泄漏到 php 进程之外，或覆盖缓冲区 1 个字节 (bsc#982162)

- CVE-2016-4346：修复了 ext/standard/string.c 中的一个堆溢出 (bsc#977994)

- CVE-2016-4342：修复了 tar/zip/phar 解析器中的一个堆损坏 (bsc#977991)

- CVE-2016-4537、CVE-2016-4538：bcpowmod 接受造成堆缓冲区溢出的反向范围并损坏 _one_ 定义 (bsc#978827)

- CVE-2016-4539：畸形输入造成 xml_parse_into_struct() 函数中发生分段错误 (bsc#978828)

- CVE-2016-4540、CVE-2016-4541：指定负偏移时 zif_grapheme_stripos 中发生越界内存读取问题 (bsc#978829)

- CVE-2016-4542、CVE-2016-4543、CVE-2016-4544：
畸形输入造成 exif_read_data() 中发生越界堆内存读取问题 (bsc#978830)

- CVE-2015-4116：spl_ptr_heap_insert 函数中的释放后使用漏洞 (bsc#980366)

- CVE-2015-8873：Zend/zend_exceptions.c 中的堆栈消耗漏洞 (bsc#980373)

- CVE-2015-8874：GD 中的堆栈消耗漏洞 (bsc#980375)

- CVE-2015-8879：ext/odbc/php_odbc.c 中的 dbc_bindcols 函数错误处理 SQL_WVARCHAR 的驱动程序行为 (bsc#981050)

之前已在 SUSE Linux Enterprise 11 SP4 上修复，但尚未在 SUSE Linux Enterprise Server 11 SP3 LTSS 中：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻击 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到类型混淆问题影响，可导致崩溃 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的空指针取消引用可导致崩溃。[bsc#968284]

- CVE-2015-7803：解压缩 tar phar 存档时存有一个堆栈溢出漏洞，其可能导致代码执行。[bsc#949961]

- CVE-2016-3141：WDDX 反序列化中的释放后使用/双重释放可导致崩溃或可能执行代码。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的越界读取可导致崩溃。[bsc#971912]

- CVE-2014-9767：已修复解压缩 zip 文件时发生的目录遍历问题，其可导致覆盖文件。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的类型混淆漏洞可导致崩溃或可能执行代码。[bsc#971611]

- CVE-2016-4073：由于错误处理 mb_strcut() 中的字符串长度计算，远程攻击者可造成拒绝服务，或执行任意代码 (bsc#977003)

- CVE-2015-8867：PHP 函数 openssl_random_pseudo_bytes() 未返回以加密方式保护的随机字节 (bsc#977005)

- CVE-2016-4070：libxml_disable_entity_loader() 设置在线程之间共享，其可导致 XML 外部实体注入和实体扩展问题 (bsc#976997)

- CVE-2015-8866：由于错误处理 php_raw_url_encode() 中的大型字符串，远程攻击者可造成拒绝服务 (bsc#976996)

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for php53 fixes the following issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961] Note: we do not ship the     phar extension currently, so we are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AMD
  - apache_mod_php
  - AppleGraphicsControl
  - AppleGraphicsPowerManagement
  - Assistant
  - ATS
  - Audio
  - Captive
  - CFNetwork
  - CommonCrypto
  - CoreCapture
  - CoreStorage
  - Crash
  - Disk
  - Disk
  - Driver
  - Drivers
  - Drivers
  - Graphics
  - Graphics
  - Graphics
  - ImageIO
  - Images
  - Intel
  - IOAcceleratorFamily
  - IOAudioFamily
  - IOFireWireFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - Lock
  - MapKit
  - Messages
  - Multi-Touch
  - Network
  - NVIDIA
  - OpenGL
  - Proxies
  - QuickTime
  - Reporter
  - SceneKit
  - Screen
  - Tcl
  - Utility

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update for php53 fixes the following issues :

  - CVE-2016-5093: A get_icu_value_internal out-of-bounds     read could crash the php interpreter (bsc#982010)

  - CVE-2016-5094,CVE-2016-5095: Don't allow creating     strings with lengths outside int range, avoids overflows     (bsc#982011,bsc#982012)

  - CVE-2016-5096: A int/size_t confusion in fread could     corrupt memory (bsc#982013)

  - CVE-2016-5114: A fpm_log.c memory leak and buffer     overflow could leak information out of the php process     or overwrite a buffer by 1 byte (bsc#982162)

  - CVE-2016-4346: A heap overflow was fixed in     ext/standard/string.c (bsc#977994)

  - CVE-2016-4342: A heap corruption was fixed in     tar/zip/phar parser (bsc#977991)

  - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative     scale causing heap buffer overflow corrupting _one_     definition (bsc#978827)

  - CVE-2016-4539: Malformed input causes segmentation fault     in xml_parse_into_struct() function (bsc#978828)

  - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read     in zif_grapheme_stripos when given negative offset     (bsc#978829)

  - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544:
    Out-of-bounds heap memory read in exif_read_data()     caused by malformed input (bsc#978830)

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function (bsc#980366)

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c (bsc#980373)

  - CVE-2015-8874: Stack consumption vulnerability in GD     (bsc#980375)

  - CVE-2015-8879: odbc_bindcols function in     ext/odbc/php_odbc.c mishandles driver behavior for     SQL_WVARCHAR (bsc#981050)

Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961]

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

  - CVE-2016-4073: A remote attacker could have caused     denial of service, or possibly execute arbitrary code,     due to incorrect handling of string length calculations     in mb_strcut() (bsc#977003)

  - CVE-2015-8867: The PHP function     openssl_random_pseudo_bytes() did not return     cryptographically secure random bytes (bsc#977005)

  - CVE-2016-4070: The libxml_disable_entity_loader()     setting was shared between threads, which could have     resulted in XML external entity injection and entity     expansion issues (bsc#976997)

  - CVE-2015-8866: A remote attacker could have caused     denial of service due to incorrect handling of large     strings in php_raw_url_encode() (bsc#976996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.5 and is affected by multiple vulnerabilities in the following components :

 - AMD
 - apache_mod_php
 - AppleGraphicsControl
 - AppleGraphicsPowerManagement
 - ATS
 - Audio
 - Captive Network Assistant
 - CFNetwork Proxies
 - CommonCrypto
 - CoreCapture
 - CoreStorage
 - Crash Reporter
 - Disk Images
 - Disk Utility
 - Graphics Drivers
 - ImageIO
 - Intel Graphics Driver
 - IOAcceleratorFamily
 - IOAudioFamily
 - IOFireWireFamily
 - IOHIDFamilyKernel
 - libc
 - libxml2
 - libxslt
 - MapKit
 - Messages
 - Multi-Touch
 - NVIDIA Graphics Drivers
 - OpenGL
 - QuickTime
 - SceneKit
 - Screen Lock
 - Tcl

Versions of PHP 5.5.x prior to 5.5.33, or 5.6.x prior to 5.6.19 are vulnerable to the following issues :

 - A use-after-free error exists in the 'php_wddx_pop_element()' function in 'ext/wddx/wddx.c'.  The issue is triggered when handling crafted XML data.  This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'phar_parse_zipfile()' function in 'ext/phar/zip.c' that may allow a remote attacker to trigger a crash or gain unauthorized access to information.

ID	名稱	產品	系列	已發布	已更新	嚴重性
90782	openSUSE 安全更新：php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
91228	Mac OS X 10.11.x < 10.11.5 多个漏洞	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91665	SUSE SLES11 安全更新：php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	2020/7/1	2023/4/25	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/4	critical
90757	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1145-1)	Nessus	SuSE Local Security Checks	2016/4/27	2021/1/19	critical
90782	openSUSE Security Update : php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
91228	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91665	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
9392	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2016/7/13	2019/3/6	high
9174	PHP 5.5.x < 5.5.33 / 5.6.x < 5.6.19 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/4/8	2019/3/6	critical

偵測

搜尋 Plugin

critical

high

critical

critical

critical

critical

critical

critical

high

critical

high

critical