This Update fixes numerous vulnerabilities in PHP. Most of them were made public during the 'Month of PHP Bugs'. The vulnerabilities potentially lead to crashes, information leaks or even execution of malicious code.

CVE-2007-1380, CVE-2007-0988, CVE-2007-1375, CVE-2007-1454 CVE-2007-1453, CVE-2007-1521, CVE-2007-1522, CVE-2007-1376 CVE-2007-1583, CVE-2007-1460, CVE-2007-1461, CVE-2007-1484 CVE-2007-1700, CVE-2007-1717, CVE-2007-1718, CVE-2007-1001 CVE-2007-1824, CVE-2007-1889, CVE-2007-1900

根据其标题，远程主机上安装的 PHP 版本早于 5.2.1。此类版本可能受到多个问题的影响，包括缓冲区溢出、格式字符串漏洞、任意代码执行、“safe_mode”和“open_basedir”绕过以及 super-global 重写。

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1375     Stefan Esser discovered that an integer overflow in the     substr_compare() function allows information disclosure     of heap memory.

  - CVE-2007-1376     Stefan Esser discovered that insufficient validation of     shared memory functions allows the disclosure of heap     memory.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1453     Stefan Esser discovered that the filtering framework     performs insufficient input validation, which allows the     execution of arbitrary code through a buffer underflow.

  - CVE-2007-1454     Stefan Esser discovered that the filtering framework can     be bypassed with a special whitespace character.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1583     Stefan Esser discovered that a programming error in the     mb_parse_str() function allows the activation of     'register_globals'.

  - CVE-2007-1700     Stefan Esser discovered that the session extension     incorrectly maintains the reference count of session     variables, which allows the execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

  - CVE-2007-1824     Stefan Esser discovered an off-by-one error in the     filtering framework, which allows the execution of     arbitrary code.

  - CVE-2007-1887     Stefan Esser discovered that a buffer overflow in the     sqlite extension allows the execution of arbitrary code.

  - CVE-2007-1889     Stefan Esser discovered that the PHP memory manager     performs an incorrect type cast, which allows the     execution of arbitrary code through buffer overflows.

  - CVE-2007-1900     Stefan Esser discovered that incorrect validation in the     email filter extension allows the injection of mail     headers.

The oldstable distribution (sarge) doesn't include php5.

バナーによると、リモートホストにインストールされている PHP のバージョンは、5.2.1 より前です。このようなバージョンは、バッファオーバーフロー、フォーマット文字列の脆弱性、任意のコードの実行、「safe_mode」および「open_basedir」のバイパス、スーパーグローバルの上書きによるデータ破壊など、いくつかの問題の影響を受けることがあります。

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.1。這些版本可能會受到多個問題的影響，包括緩衝區溢位、格式字串弱點、任意程式碼執行、「safe_mode」和「open_basedir」略過，以及超全域記憶體區域。

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001).

A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285).

The internal filter module in PHP in certain instances did not properly strip HTML tags, which allowed a remote attacker conduct cross-site scripting (XSS) attacks (CVE-2007-1454).

A vulnerability in the way the mbstring extension set global variables was discovered where a script using the mb_parse_str() function to set global variables could be forced to to enable the register_globals configuration option, possibly resulting in global variable injection (CVE-2007-1583).

A vulnerability in how PHP's mail() function processed header data was discovered. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients (CVE-2007-1718).

Updated packages have been patched to correct these issues. Also note that the default use of Suhosin helped to protect against some of these issues prior to patching.

According to its banner, the version of PHP installed on the remote host is older than 5.2.1.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
27150	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-3289)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
24907	PHP < 5.2.1 多种漏洞	Nessus	CGI abuses	2007/4/2	2025/5/26	high
25100	Debian DSA-1283-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	2007/4/30	2021/1/4	high
24907	PHP < 5.2.1 の複数の脆弱性	Nessus	CGI abuses	2007/4/2	2025/5/26	high
24907	PHP < 5.2.1 多種弱點	Nessus	CGI abuses	2007/4/2	2025/5/26	high
37164	Mandrake Linux Security Advisory : php (MDKSA-2007:090)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	high
24907	PHP < 5.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	2007/4/2	2025/5/26	high

检测

插件搜索

high

high

high

high

high

high

high