The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-693:01 advisory.

    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2014-0207     The cdf_read_short_sector function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, allows remote attackers to cause a denial of service     (assertion failure and application exit) via a crafted CDF file.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo     component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote     attackers to cause a denial of service (performance degradation) by     triggering many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component     in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers     to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-3478     Buffer overflow in the mconvert function in softmagic.c in file before     5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x     before 5.5.14, allows remote attackers to cause a denial of service     (application crash) via a crafted Pascal string in a FILE_PSTRING     conversion.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3487     The cdf_read_property_info function in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate a stream offset, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3538     file before 5.19 does not properly restrict the amount of data read     during a regex search, which allows remote attackers to cause a denial     of service (CPU consumption) via a crafted file that triggers     backtracking during processing of an awk rule.  NOTE: this     vulnerability exists because of an incomplete fix for CVE-2013-7345.
    CVE-2014-3587     Integer overflow in the cdf_read_property_info function in cdf.c in     file through 5.19, as used in the Fileinfo component in PHP before     5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a     denial of service (application crash) via a crafted CDF file.  NOTE:
    this vulnerability exists because of an incomplete fix for     CVE-2012-1571.
    CVE-2014-3710     The donote function in readelf.c in file through 5.20, as used in the     Fileinfo component in PHP 5.4.34, does not ensure that sufficient note     headers are present, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash) via a crafted     ELF file.
    CVE-2014-8116     The ELF parser (readelf.c) in file before 5.21 allows remote attackers     to cause a denial of service (CPU consumption or crash) via a large     number of (1) program or (2) section headers or (3) invalid     capabilities.
    CVE-2014-8117     softmagic.c in file before 5.21 does not properly limit recursion,     which allows remote attackers to cause a denial of service (CPU     consumption or crash) via unspecified vectors.
    CVE-2014-9652     The mconvert function in softmagic.c in file before 5.21, as used in     the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and     5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which     might allow remote attackers to cause a denial of service     (out-of-bounds memory access and application crash) via a crafted     file.
    CVE-2014-9653     readelf.c in file before 5.22, as used in the Fileinfo component in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does     not consider that pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a denial of     service (uninitialized memory access) or possibly have unspecified     other impact via a crafted ELF file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This file update fixes the following two security issues :

  - bsc#910252: multiple denial of service issues (resource     consumption) (CVE-2014-8116)

  - bsc#910253: denial of service issue (resource     consumption) (CVE-2014-8117)

Updated file packages fix security vulnerabilities :

Thomas Jarosch of Intra2net AG reported that using the file command on a specially crafted ELF binary could lead to a denial of service due to uncontrolled resource consumption (CVE-2014-8116).

Thomas Jarosch of Intra2net AG reported that using the file command on a specially crafted ELF binary could lead to a denial of service due to uncontrolled recursion (CVE-2014-8117).

The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large number of notes (CVE-2014-9620).

The ELF parser in file 5.16 through 5.21 allows remote attackers to cause a denial of service via a long string (CVE-2014-9621).

The updated file packages has been upgraded to the latest 5.22 version which is not vulnerable to these issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-325:01 advisory.

    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2014-3538     file before 5.19 does not properly restrict the amount of data read     during a regex search, which allows remote attackers to cause a denial     of service (CPU consumption) via a crafted file that triggers     backtracking during processing of an awk rule.  NOTE: this     vulnerability exists because of an incomplete fix for CVE-2013-7345.
    CVE-2014-3587     Integer overflow in the cdf_read_property_info function in cdf.c in     file through 5.19, as used in the Fileinfo component in PHP before     5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a     denial of service (application crash) via a crafted CDF file.  NOTE:
    this vulnerability exists because of an incomplete fix for     CVE-2012-1571.
    CVE-2014-3710     The donote function in readelf.c in file through 5.20, as used in the     Fileinfo component in PHP 5.4.34, does not ensure that sufficient note     headers are present, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash) via a crafted     ELF file.
    CVE-2014-8116     The ELF parser (readelf.c) in file before 5.21 allows remote attackers     to cause a denial of service (CPU consumption or crash) via a large     number of (1) program or (2) section headers or (3) invalid     capabilities.
    CVE-2014-8117     softmagic.c in file before 5.21 does not properly limit recursion,     which allows remote attackers to cause a denial of service (CPU     consumption or crash) via unspecified vectors.
    CVE-2014-9620     The ELF parser in file 5.08 through 5.21 allows remote attackers to     cause a denial of service via a large number of notes.
    CVE-2014-9653     readelf.c in file before 5.22, as used in the Fileinfo component in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does     not consider that pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a denial of     service (uninitialized memory access) or possibly have unspecified     other impact via a crafted ELF file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.
(BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688).

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.

Multiple vulnerabilities has been discovered and corrected in php :

It was discovered that the file utility contains a flaw in the handling of indirect magic rules in the libmagic library, which leads to an infinite recursion when trying to determine the file type of certain files (CVE-2014-1943).

A flaw was found in the way the file utility determined the type of Portable Executable (PE) format files, the executable format used on Windows. A malicious PE file could cause the file utility to crash or, potentially, execute arbitrary code (CVE-2014-2270).

The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters (CVE-2013-7345).

PHP FPM in PHP versions before 5.4.28 and 5.5.12 uses a UNIX domain socket with world-writable permissions by default, which allows any local user to connect to it and execute PHP scripts as the apache user (CVE-2014-0185).

A flaw was found in the way file's Composite Document Files (CDF) format parser handle CDF files with many summary info entries. The cdf_unpack_summary_info() function unnecessarily repeatedly read the info from the same offset. This led to many file_printf() calls in cdf_file_property_info(), which caused file to use an excessive amount of CPU time when parsing a specially crafted CDF file (CVE-2014-0237).

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files. A property entry with 0 elements triggers an infinite loop (CVE-2014-0238).

The unserialize() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types (CVE-2014-3515).

It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query (CVE-2014-4049).

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478).

Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487).

The phpinfo() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue that can cause it to leak arbitrary process memory (CVE-2014-4721).

Use-after-free vulnerability in ext/spl/spl_array.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted ArrayIterator usage within applications in certain web-hosting environments (CVE-2014-4698).

Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact via crafted iterator usage within applications in certain web-hosting environments (CVE-2014-4670).

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule, due to an incomplete fix for CVE-2013-7345 (CVE-2014-3538).

Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE:
this vulnerability exists because of an incomplete fix for CVE-2012-1571 (CVE-2014-3587).

Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x before 5.5.16 allow remote DNS servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted DNS record, related to the dns_get_record function and the dn_expand function. NOTE: this issue exists because of an incomplete fix for CVE-2014-4049 (CVE-2014-3597).

An integer overflow flaw in PHP's unserialize() function was reported.
If unserialize() were used on untrusted data, this issue could lead to a crash or potentially information disclosure (CVE-2014-3669).

A heap corruption issue was reported in PHP's exif_thumbnail() function. A specially crafted JPEG image could cause the PHP interpreter to crash or, potentially, execute arbitrary code (CVE-2014-3670).

If client-supplied input was passed to PHP's cURL client as a URL to download, it could return local files from the server due to improper handling of null bytes (PHP#68089).

An out-of-bounds read flaw was found in file's donote() function in the way the file utility determined the note headers of a elf file.
This could possibly lead to file executable crash (CVE-2014-3710).

A use-after-free flaw was found in PHP unserialize(). An untrusted input could cause PHP interpreter to crash or, possibly, execute arbitrary code when processed using unserialize() (CVE-2014-8142).

Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP before 5.5.21 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors (CVE-2014-9425).

sapi/cgi/cgi_main.c in the CGI component in PHP before 5.5.21, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a newline character, which causes an out-of-bounds read and might allow remote attackers to obtain sensitive information from php-cgi process memory by leveraging the ability to upload a .php file or trigger unexpected code execution if a valid PHP script is present in memory locations adjacent to the mapping (CVE-2014-9427).

Use after free vulnerability in unserialize() in PHP before 5.5.21 (CVE-2015-0231).

Free called on an uninitialized pointer in php-exif in PHP before 5.5.21 (CVE-2015-0232).

The readelf.c source file has been removed from PHP's bundled copy of file's libmagic, eliminating exposure to denial of service issues in ELF file parsing such as CVE-2014-8116, CVE-2014-8117, CVE-2014-9620 and CVE-2014-9621 in PHP's fileinfo module.

S. Paraschoudis discovered that PHP incorrectly handled memory in the enchant binding. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2014-9705).

Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-0273).

It was discovered that PHP incorrectly handled memory in the phar extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-2301).

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (CVE-2015-0231).

The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image (CVE-2015-0232).

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way libzip, which is embedded in PHP, processed certain ZIP archives. If an attacker were able to supply a specially crafted ZIP archive to an application using libzip, it could cause the application to crash or, possibly, execute arbitrary code (CVE-2015-2331).

It was discovered that the PHP opcache component incorrectly handled memory. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1351).

It was discovered that the PHP PostgreSQL database extension incorrectly handled certain pointers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1352).

PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to the libmagic issues.

The updated php packages have been patched and upgraded to the 5.5.23 version which is not vulnerable to these issues. The libzip packages has been patched to address the CVE-2015-2331 flaw.

A bug in the php zip extension that could cause a crash has been fixed (mga#13820)

Additionally the jsonc and timezonedb packages has been upgraded to the latest versions and the PECL packages which requires so has been rebuilt for php-5.5.23.

ID	名稱	產品	系列	已發布	已更新	嚴重性
289920	MiracleLinux 7 : file-5.11-31.el7 (AXSA:2015-693:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
80277	openSUSE Security Update : file (openSUSE-SU-2014:1720-1)	Nessus	SuSE Local Security Checks	2014/12/29	2021/1/19	medium
80429	Mandriva Linux Security Advisory : file (MDVSA-2015:010)	Nessus	Mandriva Local Security Checks	2015/1/9	2021/1/6	medium
289509	MiracleLinux 4 : file-5.04-30.AXS4 (AXSA:2016-325:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
87137	CentOS 7 : file (CESA-2015:2155)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	high
87555	Scientific Linux Security Update : file on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	high
82333	Mandriva Linux Security Advisory : php (MDVSA-2015:080)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	high

偵測

搜尋 Plugin

high

medium

medium

high

high

high

high