According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.21. It is, therefore, affected by multiple vulnerabilities:

  - A double free vulnerability in the     zend_ts_hash_graceful_destroy function in     zend_ts_hash.c in the Zend Engine could allow a remote     attacker to cause a denial of service. (CVE-2014-9425)

  - An out-of-bounds read flaw in file 'cgi_main.c' exists     when nmap is used to process an invalid file that begins     with a hash character (#) but lacks a newline character.
    A remote attacker, using a specially crafted PHP file,     can exploit this vulnerability to disclose memory     contents, cause a denial of service, or possibly execute     code. (CVE-2014-9427)

  - The mconvert function in softmagic.c does not properly     handle a certain string-length field during a copy of a     truncated version of a Pascal string, which could allow     a remote attacker to cause a denial of service.
    (CVE-2014-9652)

  - An out-of-bounds read issue exists in the GetCode_()     function in 'gd_gif_in.c'. This allows a remote attacker     to disclose memory contents. (CVE-2014-9709)

  - A use-after-free memory error exists in the     process_nested_data() function in 'var_unserializer.re'     due to improper handling of duplicate numerical keys     within the serialized properties of an object. A remote     attacker, using a crafted unserialize method call, can     exploit this vulnerability to execute arbitrary code.
    (CVE-2015-0231)

  - A flaw exists in the exif_process_unicode() function in     'exif.c' that allows freeing an uninitialized pointer. A     remote attacker, using specially crafted EXIF data in a     JPEG image, can exploit this to cause a denial of     service or to execute arbitrary code. (CVE-2015-0232)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The file command is used to identify a particular file according to the type of data the file contains. It can identify many different file types, including Executable and Linkable Format (ELF) binary files, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

Red Hat would like to thank Thomas Jarosch of Intra2net AG for reporting the CVE-2014-8116 and CVE-2014-8117 issues. The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3710 issues were discovered by Francisco Alonso of Red Hat Product Security; the CVE-2014-3538 issue was discovered by Jan Kaluza of the Red Hat Web Stack Team

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.
(BZ#1224667, BZ#1224668, BZ#1157850, BZ#1067688).

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487, CVE-2014-3587)

Two flaws were found in the way file processed certain Pascal strings.
A remote attacker could cause file to crash if it was used to identify the type of the attacker-supplied file. (CVE-2014-3478, CVE-2014-9652)

Multiple flaws were found in the file regular expression rules for detecting various files. A remote attacker could use these flaws to cause file to consume an excessive amount of CPU. (CVE-2014-3538)

Multiple flaws were found in the way file parsed Executable and Linkable Format (ELF) files. A remote attacker could use these flaws to cause file to crash, disclose portions of its memory, or consume an excessive amount of system resources. (CVE-2014-3710, CVE-2014-8116, CVE-2014-8117, CVE-2014-9653)

The file packages have been updated to ensure correct operation on Power little endian and ARM 64-bit hardware architectures.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1053 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. The php55 packages provide a recent stable release of PHP with     the PEAR 1.9.4, memcache 3.0.8, and mongo 1.4.5 PECL extensions, and a     number of additional utilities.

    The php55 packages have been upgraded to upstream version 5.5.21, which     provides multiple bug fixes over the version shipped in Red Hat Software     Collections 1. (BZ#1057089)

    The following security issues were fixed in the php55-php component:

    An uninitialized pointer use flaw was found in PHP's Exif extension. A     specially crafted JPEG or TIFF file could cause a PHP application using the     exif_read_data() function to crash or, possibly, execute arbitrary code     with the privileges of the user running that PHP application.
    (CVE-2015-0232)

    Multiple flaws were discovered in the way PHP performed object     unserialization. Specially crafted input processed by the unserialize()     function could cause a PHP application to crash or, possibly, execute     arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273,     CVE-2015-2787, CVE-2015-4147, CVE-2015-4148)

    A heap buffer overflow flaw was found in the enchant_broker_request_dict()     function of PHP's enchant extension. An attacker able to make a PHP     application enchant dictionaries could possibly cause it to crash.
    (CVE-2014-9705)

    A heap buffer overflow flaw was found in PHP's regular expression     extension. An attacker able to make PHP process a specially crafted regular     expression pattern could cause it to crash and possibly execute arbitrary     code. (CVE-2015-2305)

    A buffer over-read flaw was found in the GD library used by the PHP gd     extension. A specially crafted GIF file could cause a PHP application using     the imagecreatefromgif() function to crash. (CVE-2014-9709)

    A use-after-free flaw was found in PHP's OPcache extension. This flaw could     possibly lead to a disclosure of a portion of the server memory.
    (CVE-2015-1351)

    A use-after-free flaw was found in PHP's phar (PHP Archive) extension.
    An attacker able to trigger certain error condition in phar archive     processing could possibly use this flaw to disclose certain portions of     server memory. (CVE-2015-2301)

    An ouf-of-bounds read flaw was found in the way the File Information     (fileinfo) extension processed certain Pascal strings. A remote attacker     could cause a PHP application to crash if it used fileinfo to identify the     type of the attacker-supplied file. (CVE-2014-9652)

    It was found that PHP move_uploaded_file() function did not properly handle     file names with a NULL character. A remote attacker could possibly use this     flaw to make a PHP script access unexpected files and bypass intended file     system access restrictions. (CVE-2015-2348)

    A NULL pointer dereference flaw was found in PHP's pgsql extension. A     specially crafted table name passed to a function such as pg_insert() or     pg_select() could cause a PHP application to crash. (CVE-2015-1352)

    A flaw was found in the way PHP handled malformed source files when running     in CGI mode. A specially crafted PHP file could cause PHP CGI to crash.
    (CVE-2014-9427)

    All php55 users are advised to upgrade to these updated packages, which     correct these issues. After installing the updated packages, the     httpd24-httpd service must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-693:01 advisory.

    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2014-0207     The cdf_read_short_sector function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, allows remote attackers to cause a denial of service     (assertion failure and application exit) via a crafted CDF file.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo     component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote     attackers to cause a denial of service (performance degradation) by     triggering many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component     in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers     to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-3478     Buffer overflow in the mconvert function in softmagic.c in file before     5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x     before 5.5.14, allows remote attackers to cause a denial of service     (application crash) via a crafted Pascal string in a FILE_PSTRING     conversion.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3487     The cdf_read_property_info function in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate a stream offset, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3538     file before 5.19 does not properly restrict the amount of data read     during a regex search, which allows remote attackers to cause a denial     of service (CPU consumption) via a crafted file that triggers     backtracking during processing of an awk rule.  NOTE: this     vulnerability exists because of an incomplete fix for CVE-2013-7345.
    CVE-2014-3587     Integer overflow in the cdf_read_property_info function in cdf.c in     file through 5.19, as used in the Fileinfo component in PHP before     5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a     denial of service (application crash) via a crafted CDF file.  NOTE:
    this vulnerability exists because of an incomplete fix for     CVE-2012-1571.
    CVE-2014-3710     The donote function in readelf.c in file through 5.20, as used in the     Fileinfo component in PHP 5.4.34, does not ensure that sufficient note     headers are present, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash) via a crafted     ELF file.
    CVE-2014-8116     The ELF parser (readelf.c) in file before 5.21 allows remote attackers     to cause a denial of service (CPU consumption or crash) via a large     number of (1) program or (2) section headers or (3) invalid     capabilities.
    CVE-2014-8117     softmagic.c in file before 5.21 does not properly limit recursion,     which allows remote attackers to cause a denial of service (CPU     consumption or crash) via unspecified vectors.
    CVE-2014-9652     The mconvert function in softmagic.c in file before 5.21, as used in     the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and     5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which     might allow remote attackers to cause a denial of service     (out-of-bounds memory access and application crash) via a crafted     file.
    CVE-2014-9653     readelf.c in file before 5.22, as used in the Fileinfo component in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does     not consider that pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a denial of     service (uninitialized memory access) or possibly have unspecified     other impact via a crafted ELF file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
81081	PHP 5.5.x < 5.5.21 Multiple Vulnerabilities	Nessus	CGI abuses	2015/1/29	2025/5/26	critical
87137	CentOS 7 : file (CESA-2015:2155)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	high
87555	Scientific Linux Security Update : file on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	high
234382	RHEL 6 / 7 : php55 (RHSA-2015:1053)	Nessus	Red Hat Local Security Checks	2025/4/15	2025/4/15	critical
289920	MiracleLinux 7 : file-5.11-31.el7 (AXSA:2015-693:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

偵測

搜尋 Plugin

critical

high

high

critical

high