The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory.

    - fix use after free CVE-2015-1351

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-693:01 advisory.

    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2014-0207     The cdf_read_short_sector function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, allows remote attackers to cause a denial of service     (assertion failure and application exit) via a crafted CDF file.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo     component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote     attackers to cause a denial of service (performance degradation) by     triggering many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component     in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers     to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-3478     Buffer overflow in the mconvert function in softmagic.c in file before     5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x     before 5.5.14, allows remote attackers to cause a denial of service     (application crash) via a crafted Pascal string in a FILE_PSTRING     conversion.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3487     The cdf_read_property_info function in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate a stream offset, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3538     file before 5.19 does not properly restrict the amount of data read     during a regex search, which allows remote attackers to cause a denial     of service (CPU consumption) via a crafted file that triggers     backtracking during processing of an awk rule.  NOTE: this     vulnerability exists because of an incomplete fix for CVE-2013-7345.
    CVE-2014-3587     Integer overflow in the cdf_read_property_info function in cdf.c in     file through 5.19, as used in the Fileinfo component in PHP before     5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a     denial of service (application crash) via a crafted CDF file.  NOTE:
    this vulnerability exists because of an incomplete fix for     CVE-2012-1571.
    CVE-2014-3710     The donote function in readelf.c in file through 5.20, as used in the     Fileinfo component in PHP 5.4.34, does not ensure that sufficient note     headers are present, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash) via a crafted     ELF file.
    CVE-2014-8116     The ELF parser (readelf.c) in file before 5.21 allows remote attackers     to cause a denial of service (CPU consumption or crash) via a large     number of (1) program or (2) section headers or (3) invalid     capabilities.
    CVE-2014-8117     softmagic.c in file before 5.21 does not properly limit recursion,     which allows remote attackers to cause a denial of service (CPU     consumption or crash) via unspecified vectors.
    CVE-2014-9652     The mconvert function in softmagic.c in file before 5.21, as used in     the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and     5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which     might allow remote attackers to cause a denial of service     (out-of-bounds memory access and application crash) via a crafted     file.
    CVE-2014-9653     readelf.c in file before 5.22, as used in the Fileinfo component in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does     not consider that pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a denial of     service (uninitialized memory access) or possibly have unspecified     other impact via a crafted ELF file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1053 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. The php55 packages provide a recent stable release of PHP with     the PEAR 1.9.4, memcache 3.0.8, and mongo 1.4.5 PECL extensions, and a     number of additional utilities.

    The php55 packages have been upgraded to upstream version 5.5.21, which     provides multiple bug fixes over the version shipped in Red Hat Software     Collections 1. (BZ#1057089)

    The following security issues were fixed in the php55-php component:

    An uninitialized pointer use flaw was found in PHP's Exif extension. A     specially crafted JPEG or TIFF file could cause a PHP application using the     exif_read_data() function to crash or, possibly, execute arbitrary code     with the privileges of the user running that PHP application.
    (CVE-2015-0232)

    Multiple flaws were discovered in the way PHP performed object     unserialization. Specially crafted input processed by the unserialize()     function could cause a PHP application to crash or, possibly, execute     arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273,     CVE-2015-2787, CVE-2015-4147, CVE-2015-4148)

    A heap buffer overflow flaw was found in the enchant_broker_request_dict()     function of PHP's enchant extension. An attacker able to make a PHP     application enchant dictionaries could possibly cause it to crash.
    (CVE-2014-9705)

    A heap buffer overflow flaw was found in PHP's regular expression     extension. An attacker able to make PHP process a specially crafted regular     expression pattern could cause it to crash and possibly execute arbitrary     code. (CVE-2015-2305)

    A buffer over-read flaw was found in the GD library used by the PHP gd     extension. A specially crafted GIF file could cause a PHP application using     the imagecreatefromgif() function to crash. (CVE-2014-9709)

    A use-after-free flaw was found in PHP's OPcache extension. This flaw could     possibly lead to a disclosure of a portion of the server memory.
    (CVE-2015-1351)

    A use-after-free flaw was found in PHP's phar (PHP Archive) extension.
    An attacker able to trigger certain error condition in phar archive     processing could possibly use this flaw to disclose certain portions of     server memory. (CVE-2015-2301)

    An ouf-of-bounds read flaw was found in the way the File Information     (fileinfo) extension processed certain Pascal strings. A remote attacker     could cause a PHP application to crash if it used fileinfo to identify the     type of the attacker-supplied file. (CVE-2014-9652)

    It was found that PHP move_uploaded_file() function did not properly handle     file names with a NULL character. A remote attacker could possibly use this     flaw to make a PHP script access unexpected files and bypass intended file     system access restrictions. (CVE-2015-2348)

    A NULL pointer dereference flaw was found in PHP's pgsql extension. A     specially crafted table name passed to a function such as pg_insert() or     pg_select() could cause a PHP application to crash. (CVE-2015-1352)

    A flaw was found in the way PHP handled malformed source files when running     in CGI mode. A specially crafted PHP file could cause PHP CGI to crash.
    (CVE-2014-9427)

    All php55 users are advised to upgrade to these updated packages, which     correct these issues. After installing the updated packages, the     httpd24-httpd service must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
181066	Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2025/4/29	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	2015/6/24	2021/1/4	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	2015/6/24	2021/2/5	critical
289920	MiracleLinux 7 : file-5.11-31.el7 (AXSA:2015-693:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
234382	RHEL 6 / 7 : php55 (RHSA-2015:1053)	Nessus	Red Hat Local Security Checks	2025/4/15	2025/4/15	critical

偵測

搜尋 Plugin

critical

critical

critical

high

critical