在 PHP 中發現多個弱點，PHP 是常用於 web 應用程式開發的一般用途指令碼語言。

將 PHP 升級至包含其他錯誤修正的新上游版本 (5.4.45 和 5.6.13) 後，弱點即可得到解決。
如需詳細資訊，請參閱上游變更記錄：

- https://php.net/ChangeLog-5.php#5.4.45
 - https://php.net/ChangeLog-5.php#5.6.13

2015 年 9 月 3 日 **PHP 5.6.13** **核心：** * 修正錯誤 #69900 (管道上逾時過久)。(Anatol) * 已修正錯誤 #69487 (SAPI 可能會截斷 POST 資料)。(cmb) * 已修正錯誤 #70198 (檢查 liveness 是否未如預期運作)。(Shafreeck Sea、Anatol Belski) * 已修正錯誤 #70172 (unserialize() 中的釋放後使用弱點)。(Stas) * 已修正錯誤 #70219 (工作階段還原序列化程式中的釋放後使用弱點)。(taoguangchen@icloud.com) **CLI 伺服器：** * 已修正錯誤 #66606 (設定 HTTP_CONTENT_TYPE 但未設定 CONTENT_TYPE)。(wusuopu、cmb) * 已修正錯誤 #70264 (CLI 伺服器目錄遊走)。(cmb) **日期：** * 已修正錯誤 #70266 (DateInterval::__construct.interval_spec 不應為選用)。(cmb)

- 修正錯誤 #70277 (新的 DateTimeZone($foo) 忽略 null 位元組之後的文字)。(cmb) **EXIF：** * 已修正錯誤 #70385 (含有 32 位元組 TIFF IFD 標籤位元組值的 exif_read_data 中發生緩衝區過度讀取)。(Stas) **雜湊：** * 已修正錯誤 #70312 (HAVAL 在特定狀況下提供錯誤的雜湊)。
 (letsgolee@naver.com) **MCrypt：** * 已修正錯誤 #69833 (mcrypt fd 快取無作用)。(Anatol)
**Opcache：** * 修正錯誤 #70237 (啟用 CLI 時，opcode 發生空 while 和 do-while 分割錯誤)。
 (Dmitry、Laruence) **PCRE：** * 已修正錯誤 #70232 (\K 和空字串符合的錯誤 bump-along 行為)。(cmb) * 已修正錯誤 #70345 (多個與 PCRE 函式有關的弱點)。(Anatol Belski) **SOAP：** * 已修正錯誤 #70388 (SOAP serialize_function_call() 類型混淆 / RCE)。(Stas)
**SPL：** * 修正錯誤 #70290 (spl_autoload 中透過 ob_start 引發的 NULL 指標解除參照 (segfault))。(hugh@allthethings.co.nz) * 修正錯誤 #70303 (ArrayObject 的錯誤建構函式反射)。
 (cmb) * 已修正錯誤 #70365 (unserialize() 中利用 SplObjectStorage 引發的釋放後使用弱點)。(taoguangchen@icloud.com) * 修正錯誤 #70366 (unserialize() 中利用 SplDoublyLinkedList 引發的釋放後使用弱點)。(taoguangchen@icloud.com)
**標準：** * 修正錯誤 #70052 (極大和極小的 WBMP 之 getimagesize() 失敗)。(cmb) * 已修正錯誤 #70157 (透過 INI_SCANNER_TYPED 引發的 parse_ini_string() 分割錯誤)。(Tjerk) **XSLT：** * 已修正錯誤 #69782 (NULL 指標解除參照)。(Stas)

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

在 unserialize() 函式中發現一個釋放後使用弱點。我們可以透過 Serializable::unserialize 建立並釋放 ZVAL。不過 unserialize() 仍會繼續允許使用 R: 或 r: 將參照設為已釋放記憶體的項目。這可能會導致從遠端發動釋放後使用攻擊並執行任意程式碼。

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.1 and is affected by multiple vulnerabilities in the following components :

 - Accelerate Framework (CVE-2015-5940)
 - apache_mod_php (CVE-2015-0235, CVE-2015-0273, CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838)
 - ATS (CVE-2015-6985)
 - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)
 - Bom (CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Directory Utility (CVE-2015-6980)
 - Disk Images (CVE-2015-6995)
 - EFI (CVE-2015-7035)
 - File Bookmark (CVE-2015-6987)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Drivers (CVE-2015-7019, CVE-2015-7020, CVE-2015-7021)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5938, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)
 - libarchive (CVE-2015-6984)
 - MCX Application Restrictions (CVE-2015-7016)
 - Net-SNMP (CVE-2014-3565, CVE-2012-6151)
 - OpenGL (CVE-2015-5924)
 - OpenSSH (CVE-2015-6563)
 - Sandbox (CVE-2015-5945)
 - Script Editor (CVE-2015-7007)
 - Security (CVE-2015-6983, CVE-2015-7024)
 - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Versions of PHP 5.4.x prior to 5.4.45, 5.5.x prior to 5.5.29, or 5.6.x prior to 5.6.13 are vulnerable to the following issues :

  - A use-after-free error exists in the unserialize() function in 'ext/spl/spl_observer.c'. The issue is triggered as user-supplied input is not sanitized. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw affects the serialize_function_call() function in 'ext/soap/soap.c'. The issue is triggered when handling input passed via the header field. This may allow a remote attacker to execute arbitrary code.
 - A use-after-free error affects the object_custom() function in 'ext/standard/var_unserializer.c'. The issue is triggered when handling user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error affects the unserialize() function in 'ext/spl/spl_dllist.c'. The issue is triggered during the deserialization of user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw in the exif_process_IFD_TAG() function in 'ext/exif/exif.c' that is triggered when handling TIFF IFD tags. This may allow a context-dependent attacker to crash an application linked against PHP or potentially disclose memory contents.
 - An overflow condition exists in the php_pcre_match_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the php_pcre_split_impl() function in 'ext/pcre/php_pcre.c'. The flaw is triggered during the handling of offsets that consist of a start and end position within the subject string, which can cause an exhaustion of memory resources. This may allow a remote attacker to exhaust available memory.
 - An overflow condition affects the php_pcre_replace_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated when handling offsets. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the php_var_unserialize() function of the session deserializer (php_binary/php_serialize). The issue is triggered when deserializing multiple forms of data. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A NULL pointer dereference flaw exists in the xsl_ext_function_php() function in 'ext/xsl/xsltprocessor.c' that is triggered as checks are not properly performed on user-supplied input. This may allow a remote attacker to cause a denial of service.
 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the php_zip_extract_file() function in 'ext/zip/php_zip.c' not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') passed to the ZipArchive::extractTo() method. This may allow a remote attacker to create arbitrary directories.

ID	名稱	產品	系列	已發布	已更新	嚴重性
85914	Debian DSA-3358-1：php5 - 安全性更新	Nessus	Debian Local Security Checks	2015/9/14	2021/1/11	critical
85933	Fedora 21：php-5.6.13-1.fc21 (2015-14976)	Nessus	Fedora Local Security Checks	2015/9/15	2021/1/11	critical
91433	F5 Networks BIG-IP：多個 PHP 弱點 (SOL17377)	Nessus	F5 Networks Local Security Checks	2016/6/2	2019/4/11	critical
9324	Mac OS X 10.9.5 or later < 10.11.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2016/5/27	2019/3/6	critical
8861	PHP 5.4.x < 5.4.45 / 5.5.x < 5.5.29 / 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2015/9/14	2019/3/6	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical