According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer underflow flaw leading to out-of-bounds     memory access was found in the way PHP's Phar extension     parsed Phar archives. A specially crafted archive could     cause PHP to crash or, possibly, execute arbitrary code     when opened.(CVE-2015-4021)

  - An out of bounds read flaw was found in the way the     xmlrpc extension parsed dates in the ISO 8601 format. A     specially crafted XML-RPC request or response could     possibly cause a PHP application to     crash.(CVE-2014-3668)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4598)

  - A flaw was found in the way PHP handled malformed     source files when running in CGI mode. A specially     crafted PHP file could cause PHP CGI to     crash.(CVE-2014-9427)

  - An issue was discovered in PHP before 5.6.36, 7.0.x     before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before     7.2.5. ext/ldap/ldap.c allows remote LDAP servers to     cause a denial of service (NULL pointer dereference and     application crash) because of mishandling of the     ldap_get_dn return value.(CVE-2018-10548)

  - An infinite loop vulnerability was found in     ext/iconv/iconv.c in PHP due to the iconv stream not     rejecting invalid multibyte sequences. A remote     attacker could use this vulnerability to hang the php     process and consume resources.(CVE-2018-10546)

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to     CVE-2009-2408.(CVE-2013-4248)

  - A use-after-free flaw was found in the way PHP's     unserialize() function processed data. If a remote     attacker was able to pass crafted input to PHP's     unserialize() function, they could cause the PHP     interpreter to crash or, possibly, execute arbitrary     code.(CVE-2015-0231)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4602)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-3412)

  - The mcopy function in softmagic.c in file 5.x, as used     in the Fileinfo component in PHP before 5.4.40, 5.5.x     before 5.5.24, and 5.6.x before 5.6.8, does not     properly restrict a certain offset value, which allows     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a crafted string that is mishandled by a 'Python     script text executable' rule.(CVE-2015-4605)

  - A heap buffer overflow flaw was found in the     enchant_broker_request_dict() function of PHP's enchant     extension. A specially crafted tag input could possibly     cause a PHP application to crash.(CVE-2014-9705)

  - A buffer overflow flaw was found in the Exif extension.
    A specially crafted JPEG or TIFF file could cause a PHP     application using the exif_thumbnail() function to     crash or, possibly, execute arbitrary code with the     privileges of the user running that PHP     application.(CVE-2014-3670)

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4148)

  - A type confusion issue was found in the SPL ArrayObject     and SPLObjectStorage classes' unserialize() method. A     remote attacker able to submit specially crafted input     to a PHP application, which would then unserialize this     input using one of the aforementioned methods, could     use this flaw to execute arbitrary code with the     privileges of the user running that PHP     application.(CVE-2014-3515)

  - The mget function in softmagic.c in file 5.x, as used     in the Fileinfo component in PHP before 5.4.40, 5.5.x     before 5.5.24, and 5.6.x before 5.6.8, does not     properly maintain a certain pointer relationship, which     allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a crafted string that is mishandled by a 'Python     script text executable' rule.(CVE-2015-4604)

  - A NULL pointer dereference flaw was found in the     gdImageCreateFromXpm() function of PHP's gd extension.
    A remote attacker could use this flaw to crash a PHP     application using gd via a specially crafted X PixMap     (XPM) file.(CVE-2014-2497)

  - A flaw was found in the way PHP parsed multipart HTTP     POST requests. A specially crafted request could cause     PHP to use an excessive amount of CPU     time.(CVE-2015-4024)

  - Multiple flaws were discovered in the way PHP's Soap     extension performed object unserialization. Specially     crafted input processed by the unserialize() function     could cause a PHP application to disclose portion of     its memory or crash.(CVE-2015-4599)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4603)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated php packages fix security vulnerabilities :

The unserialize() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types (CVE-2014-3515).

It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query (CVE-2014-4049).

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478).

Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487).

PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to this issue. It has been updated to versions 5.5.14, which fix this issue and several other bugs.

The phpinfo() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue that can cause it to leak arbitrary process memory (CVE-2014-4721).

Additionally, php-apc has been rebuilt against the updated php packages and the php-timezonedb packages has been upgraded to the 2014.5 version.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1012 advisory.

    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
    - core: fix heap-based buffer overflow in DNS TXT record parsing.
      CVE-2014-4049
    - core: unserialize() SPL ArrayObject / SPLObjectStorage type       confusion flaw. CVE-2014-3515
    - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
    - fileinfo: unrestricted recursion in handling of indirect type       rules. CVE-2014-1943
    - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
    - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2014-0207     Francisco Alonso of the Red Hat Security Response Team     reported an incorrect boundary check in the     cdf_read_short_sector() function.

  - CVE-2014-3478     Francisco Alonso of the Red Hat Security Response Team     discovered a flaw in the way the truncated pascal string     size in the mconvert() function is computed.

  - CVE-2014-3479     Francisco Alonso of the Red Hat Security Response Team     reported an incorrect boundary check in the     cdf_check_stream_offset() function.

  - CVE-2014-3480     Francisco Alonso of the Red Hat Security Response Team     reported an insufficient boundary check in the     cdf_count_chain() function.

  - CVE-2014-3487     Francisco Alonso of the Red Hat Security Response Team     discovered an incorrect boundary check in the     cdf_read_property_info() funtion.

  - CVE-2014-3515     Stefan Esser discovered that the ArrayObject and the     SPLObjectStorage unserialize() handler do not verify the     type of unserialized data before using it. A remote     attacker could use this flaw to execute arbitrary code.

  - CVE-2014-4721     Stefan Esser discovered a type confusion issue affecting     phpinfo(), which might allow an attacker to obtain     sensitive information from process memory.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2013-7345)

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso of Red Hat Product Security.

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

[CVE-2014-3515]: fix unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

[CVE-2014-0207]: fileinfo: cdf_read_short_sector insufficient boundary check

[CVE-2014-3480]: fileinfo: cdf_count_chain insufficient boundary check

[CVE-2014-4721]: The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF variables, which might allow context-dependent attackers to obtain sensitive information from process memory by using the integer data type with crafted values, related to a 'type confusion' vulnerability, as demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl and a PHP 5.3.x mod_php.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components :

  - apache_mod_php
  - Bluetooth
  - CoreGraphics
  - Foundation
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - ruby

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名稱	產品	系列	已發布	已更新	嚴重性
124997	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
76438	Mandriva Linux Security Advisory : php (MDVSA-2014:130)	Nessus	Mandriva Local Security Checks	2014/7/10	2021/1/6	high
77043	Oracle Linux 5 / 6 : php53 / and / php (ELSA-2014-1012)	Nessus	Oracle Linux Local Security Checks	2014/8/7	2024/10/22	medium
76418	Debian DSA-2974-1 : php5 - security update	Nessus	Debian Local Security Checks	2014/7/9	2021/1/11	high
77033	CentOS 7 : php (CESA-2014:1013)	Nessus	CentOS Local Security Checks	2014/8/7	2021/1/4	high
82165	Debian DLA-18-1 : php5 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
77748	Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2014/9/18	2024/5/28	critical

偵測

搜尋 Plugin

critical

high

medium

high

high

high

critical