- CVE-2015-6831 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6832 Dangling pointer in the unserialization of     ArrayObject items.

  - CVE-2015-6833 Files extracted from archive may be placed     outside of destination directory

  - CVE-2015-6834 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6836 A type confusion occurs within SOAP     serialize_function_call due to an insufficient     validation of the headers field. In the SoapClient's
    __call method, the verify_soap_headers_array check is     applied only to headers retrieved from     zend_parse_parameters; problem is that a few lines     later, soap_headers could be updated or even replaced     with values from the __default_headers object fields.

  - CVE-2015-6837 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-6838 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-7803 A NULL pointer dereference flaw was found     in the way PHP's Phar extension parsed Phar archives. A     specially crafted archive could cause PHP to crash.

  - CVE-2015-7804 An uninitialized pointer use flaw was     found in the phar_make_dirstream() function of PHP's     Phar extension. A specially crafted phar file in the ZIP     format with a directory entry with a file name '/ZIP'     could cause a PHP application function to crash.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-140:02 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated web pages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    This package contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP 2.4 Server.
    Security issues fixed with this release:
    CVE-2015-5589
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5590     Stack-based buffer overflow in the phar_fix_filepath function in     ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x     before 5.6.11 allows remote attackers to cause a denial of service or     possibly have unspecified other impact via a large length value, as     demonstrated by mishandling of an e-mail attachment by the imap PHP     extension.
    CVE-2015-6831     Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44,     5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to     execute arbitrary code via vectors involving (1) ArrayObject, (2)     SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled     during unserialization.
    CVE-2015-6832     Use-after-free vulnerability in the SPL unserialize implementation in     ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and     5.6.x before 5.6.12 allows remote attackers to execute arbitrary code     via crafted serialized data that triggers misuse of an array field.
    CVE-2015-6833     Directory traversal vulnerability in the PharData class in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to write to arbitrary files via a .. (dot dot) in a ZIP     archive entry that is mishandled during an extractTo call.
    CVE-2015-6834
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6835
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6836     The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45,     5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage     headers, which allows remote attackers to execute arbitrary code via     crafted serialized data that triggers a type confusion in the     serialize_function_call function.
    CVE-2015-6837
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6838
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7803     The phar_get_entry_data function in ext/phar/util.c in PHP before     5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via     a .phar file with a crafted TAR archive entry in which the Link     indicator references a file that does not exist.
    CVE-2015-7804     Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c     in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers     to cause a denial of service (uninitialized pointer dereference and     application crash) by including the / filename in a .zip PHAR archive.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb)

  - Fixed bug #70277 (new DateTimeZone($foo) is ignoring     text after null byte). (cmb) **EXIF:** * Fixed bug     #70385 (Buffer over-read in exif_read_data with TIFF IFD     tag byte value of 32 bytes). (Stas) **hash:** * Fixed     bug #70312 (HAVAL gives wrong hashes in specific cases).
    (letsgolee at naver dot com) **MCrypt:** * Fixed bug     #69833 (mcrypt fd caching not working). (Anatol)
    **Opcache:** * Fixed bug #70237 (Empty while and     do-while segmentation fault with opcode on CLI enabled).
    (Dmitry, Laruence) **PCRE:** * Fixed bug #70232     (Incorrect bump-along behavior with \K and empty string     match). (cmb) * Fixed bug #70345 (Multiple     vulnerabilities related to PCRE functions). (Anatol     Belski) **SOAP:** * Fixed bug #70388 (SOAP     serialize_function_call() type confusion / RCE). (Stas)
    **SPL:** * Fixed bug #70290 (NULL pointer deref     (segfault) in spl_autoload via ob_start). (hugh at     allthethings dot co dot nz) * Fixed bug #70303     (Incorrect constructor reflection for ArrayObject).
    (cmb) * Fixed bug #70365 (Use-after-free vulnerability     in unserialize() with SplObjectStorage). (taoguangchen     at icloud dot com) * Fixed bug #70366 (Use-after-free     vulnerability in unserialize() with     SplDoublyLinkedList). (taoguangchen at icloud dot com)
    **Standard:** * Fixed bug #70052 (getimagesize() fails     for very large and very small WBMP). (cmb) * Fixed bug     #70157 (parse_ini_string() segmentation fault with     INI_SCANNER_TYPED). (Tjerk) **XSLT:** * Fixed bug #69782     (NULL pointer dereference). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP5 script interpreter was updated to fix various security issues :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403] 

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2758-1 advisory.

    It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589)

    It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5590)

    Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

    Sean Heelan discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6832)

    It was discovered that the PHP phar extension incorrectly handled certain archives. A remote attacker     could use this issue to cause files to be placed outside of the destination directory. (CVE-2015-6833)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-6836)

    It was discovered that the PHP XSLTProcessor class incorrectly handled certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-6837)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-004 or 2015-007. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework
  - apache_mod_php
  - ATS
  - Audio
  - CFNetwork
  - CoreGraphics
  - CoreText
  - EFI
  - FontParser
  - Grand Central Dispatch
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - libarchive
  - MCX Application Restrictions
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-144:01 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated web pages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    This package contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP 2.4 Server.
    Security issues fixed with this release:
    CVE-2015-5589
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5590     Stack-based buffer overflow in the phar_fix_filepath function in     ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x     before 5.6.11 allows remote attackers to cause a denial of service or     possibly have unspecified other impact via a large length value, as     demonstrated by mishandling of an e-mail attachment by the imap PHP     extension.
    CVE-2015-6831     Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44,     5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to     execute arbitrary code via vectors involving (1) ArrayObject, (2)     SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled     during unserialization.
    CVE-2015-6832     Use-after-free vulnerability in the SPL unserialize implementation in     ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and     5.6.x before 5.6.12 allows remote attackers to execute arbitrary code     via crafted serialized data that triggers misuse of an array field.
    CVE-2015-6833     Directory traversal vulnerability in the PharData class in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to write to arbitrary files via a .. (dot dot) in a ZIP     archive entry that is mishandled during an extractTo call.
    CVE-2015-6834
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6835
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6836     The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45,     5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage     headers, which allows remote attackers to execute arbitrary code via     crafted serialized data that triggers a type confusion in the     serialize_function_call function.
    CVE-2015-6837
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6838
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7803     The phar_get_entry_data function in ext/phar/util.c in PHP before     5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via     a .phar file with a crafted TAR archive entry in which the Link     indicator references a file that does not exist.
    CVE-2015-7804     Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c     in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers     to cause a denial of service (uninitialized pointer dereference and     application crash) by including the / filename in a .zip PHAR archive.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Use after free vulnerability was found in unserialize() function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

ID	名稱	產品	系列	已發布	已更新	嚴重性
86794	Debian DLA-341-1 : php5 security update	Nessus	Debian Local Security Checks	2015/11/9	2021/1/11	critical
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/6/20	2021/1/11	critical
289070	MiracleLinux 7 : rh-php56-php-5.6.5-8.el7 (AXSA:2016-140:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
85933	Fedora 21 : php-5.6.13-1.fc21 (2015-14976)	Nessus	Fedora Local Security Checks	2015/9/15	2021/1/11	critical
86183	openSUSE Security Update : php5 (openSUSE-2015-609)	Nessus	SuSE Local Security Checks	2015/9/28	2021/1/19	critical
86221	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2758-1)	Nessus	Ubuntu Local Security Checks	2015/10/1	2024/8/27	critical
86223	Slackware 14.0 / 14.1 / current : php (SSA:2015-274-02)	Nessus	Slackware Local Security Checks	2015/10/2	2021/1/14	critical
89967	Amazon Linux AMI : php54 (ALAS-2016-670)	Nessus	Amazon Linux Local Security Checks	2016/3/17	2019/4/11	critical
86829	Mac OS X Multiple Vulnerabilities (Security Updates 2015-004 / 2015-007)	Nessus	MacOS X Local Security Checks	2015/11/10	2024/5/28	critical
291542	MiracleLinux 4 : rh-php56-php-5.6.5-8.AXS4 (AXSA:2016-144:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
86030	Fedora 23 : php-5.6.13-1.fc23 (2015-14978)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	critical
91433	F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)	Nessus	F5 Networks Local Security Checks	2016/6/2	2019/4/11	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical