The remote host is affected by the vulnerability described in GLSA-200710-02 (PHP: Multiple vulnerabilities)

    Several vulnerabilities were found in PHP. Mattias Bengtsson and Philip     Olausson reported integer overflows in the gdImageCreate() and     gdImageCreateTrueColor() functions of the GD library which can cause     heap-based buffer overflows (CVE-2007-3996). Gerhard Wagner discovered     an integer overflow in the chunk_split() function that can lead to a     heap-based buffer overflow (CVE-2007-2872). Its incomplete fix caused     incorrect buffer size calculation due to precision loss, also resulting     in a possible heap-based buffer overflow (CVE-2007-4661 and     CVE-2007-4660). A buffer overflow in the sqlite_decode_binary() of the     SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1     was not fixed correctly (CVE-2007-1887).
    Stefan Esser discovered an error in the zend_alter_ini_entry() function     handling a memory_limit violation (CVE-2007-4659). Stefan Esser also     discovered a flaw when handling interruptions with userspace error     handlers that can be exploited to read arbitrary heap memory     (CVE-2007-1883). Disclosure of sensitive memory can also be triggered     due to insufficient boundary checks in the strspn() and strcspn()     functions, an issue discovered by Mattias Bengtsson and Philip Olausson     (CVE-2007-4657)     Stefan Esser reported incorrect validation in the FILTER_VALIDATE_EMAIL     filter of the Filter extension allowing arbitrary email header     injection (CVE-2007-1900). NOTE: This CVE was referenced, but not fixed     in GLSA 200705-19.
    Stanislav Malyshev found an error with unknown impact in the     money_format() function when processing '%i' and '%n' tokens     (CVE-2007-4658). zatanzlatan reported a buffer overflow in the     php_openssl_make_REQ() function with unknown impact when providing a     manipulated SSL configuration file (CVE-2007-4662). Possible memory     corruption when trying to read EXIF data in exif_read_data() and     exif_thumbnail() occurred with unknown impact.
    Several vulnerabilities that allow bypassing of open_basedir and other     restrictions were reported, including the glob() function     (CVE-2007-4663), the session_save_path(), ini_set(), and error_log()     functions which can allow local command execution (CVE-2007-3378),     involving the readfile() function (CVE-2007-3007), via the Session     extension (CVE-2007-4652), via the MySQL extension (CVE-2007-3997) and     in the dl() function which allows loading extensions outside of the     specified directory (CVE-2007-4825).
    Multiple Denial of Service vulnerabilities were discovered, including a     long 'library' parameter in the dl() function (CVE-2007-4887), in     several iconv and xmlrpc functions (CVE-2007-4840 and CVE-2007-4783),     in the setlocale() function (CVE-2007-4784), in the glob() and     fnmatch() function (CVE-2007-4782 and CVE-2007-3806), a floating point     exception in the wordwrap() function (CVE-2007-3998), a stack     exhaustion via deeply nested arrays (CVE-2007-4670), an infinite loop     caused by a specially crafted PNG image in the png_read_info() function     of libpng (CVE-2007-2756) and several issues related to array     conversion.
  Impact :

    Remote attackers might be able to exploit these issues in PHP     applications making use of the affected functions, potentially     resulting in the execution of arbitrary code, Denial of Service,     execution of scripted contents in the context of the affected site,     security bypass or information leak.
  Workaround :

    There is no known workaround at this time.

バナーによると、リモートホストにインストールされている PHP のバージョンは、5.2.1 より前です。このようなバージョンは、バッファオーバーフロー、フォーマット文字列の脆弱性、任意のコードの実行、「safe_mode」および「open_basedir」のバイパス、スーパーグローバルの上書きによるデータ破壊など、いくつかの問題の影響を受けることがあります。

バナーによると、リモートホストにインストールされている PHP のバージョンは、4.4.5 より前です。このようなバージョンは、バッファオーバーフロー、フォーマット文字列の脆弱性、任意のコードの実行、「safe_mode」および「open_basedir」のバイパス、スーパーグローバルの上書きによるデータ破壊など、いくつかの問題の影響を受けることがあります。

According to its banner, the version of PHP installed on the remote host is older than 5.2.3. It is, therefore, affected by multiple vulnerabilities:

  - A buffer overflow in the sqlite_decode_function() in     the bundled sqlite library could allow context-dependent     attackers to execute arbitrary code. (CVE-2007-1887)

  - A CRLF injection vulnerability in the     FILTER_VALIDATE_EMAIL filter could allow an attacker to     inject arbitrary email headers via a special email     address. This only affects Mandriva Linux 2007.1.
    (CVE-2007-1900)

  - An infinite-loop flaw was discovered in the PHP gd     extension. A script that could be forced to process PNG     images from an untrusted source could allow a remote     attacker to cause a denial of service. (CVE-2007-2756)

  - An integer overflow flaw was found in the     chunk_split() function that ould possibly execute     arbitrary code as the apache user if a remote attacker     was able to pass arbitrary data to the third argument of     chunk_split() (CVE-2007-2872).

  - An open_basedir and safe_mode restriction bypass which     could allow context-dependent attackers to determine the     existence of arbitrary files. (CVE-2007-3007)

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.1。這些版本可能會受到多個問題的影響，包括緩衝區溢位、格式字串弱點、任意程式碼執行、「safe_mode」和「open_basedir」略過，以及超全域記憶體區域。

根據其標題，遠端主機上安裝的 PHP 版本舊於 4.4.5。這些版本可能會受到多個問題的影響，包括緩衝區溢位、格式字串弱點、任意程式碼執行、「safe_mode」和「open_basedir」略過，以及超全域記憶體區域。

バナーによると、リモートホストにインストールされている PHP のバージョンは 5.2.3 より前です。このようなバージョンは、整数オーバーフロー、「safe_mode」および「open_basedir」バイパス、およびサービス拒否脆弱性を含む、いくつかの問題の影響を受けることがあります。

根据其标题，远程主机上安装的 PHP 版本早于 5.2.1。此类版本可能受到多个问题的影响，包括缓冲区溢出、格式字符串漏洞、任意代码执行、“safe_mode”和“open_basedir”绕过以及 super-global 重写。

根據其標題，遠端主機上安裝的 PHP 版本舊於 5.2.3。因此，會受到多個弱點影響：

  - 隨附 sqlite 庫中的 sqlite_decode_function() 存在緩衝區溢位，這可能會允許依賴上下文的攻擊者執行任意程式碼。(CVE-2007-1887)

  - FILTER_VALIDATE_EMAIL 篩選器中的 CRLF 插入弱點可以允許攻擊者透過特殊的電子郵件地址插入任意電子郵件標頭。這只會影響 Mandriva Linux 2007.1。
    (CVE-2007-1900)

  - 在 PHP gd 延伸模組中發現無限迴圈缺陷。若指令碼可以被強制處理來自不受信任之來源的 PNG 影像，則遠端攻擊者便可利用該指令碼引致拒絕服務。(CVE-2007-2756)

  - 在 chunk_split() 函式中發現了一個整數溢位缺陷，若遠端攻擊者能夠將任意資料傳遞給 chunk_split() 的第三個引數，則該缺陷可能會以 apache 使用者的身分執行任意程式碼 (CVE-2007-2872)。

  - 一個 open_basedir 和 safe_mode 限制繞過，其可允許依賴上下文的攻擊者判斷任意檔案是否存在。(CVE-2007-3007)

根据其标题，远程主机上安装的 PHP 版本早于 5.2.3。因此，该应用程序受到多个漏洞的影响：

  - 捆绑的 sqlite 库的 sqlite_decode_function() 中存在缓冲区溢出，上下文有关的攻击者可利用此漏洞，执行任意代码。(CVE-2007-1887)

  - FILTER_VALIDATE_EMAIL 过滤器中存在 CRLF 注入漏洞，攻击者可利用此漏洞，通过特殊的电子邮件地址，注入任意电子邮件标头。此问题仅影响 Mandriva Linux 2007.1。
    (CVE-2007-1900)

  - 在 PHP gd 扩展中发现无限循环缺陷。远程攻击者可利用特定脚本，强制处理不受信任来源的 PNG 图像，进而造成拒绝服务。(CVE-2007-2756)

  - 在 chunk_split() 函数中发现整数溢出缺陷，如果远程攻击者能够将任意数据传递至 chunk_split() 的第三个参数，则可能以 Apache 用户身份执行任意代码 (CVE-2007-2872)。

  - 存在 open_basedir 和 safe_mode 限制绕过，上下文有关的攻击者可利用此漏洞，确定是否存在任意文件。(CVE-2007-3007)

根据其标题，远程主机上安装的 PHP 版本早于 4.4.5。此类版本可能受到多个问题的影响，包括缓冲区溢出、格式字符串漏洞、任意代码执行、“safe_mode”和“open_basedir”绕过以及 super-global 重写。

According to its banner, the version of PHP installed on the remote host is older than 4.4.5.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

Several remote vulnerabilities have been discovered in PHP, a server-side, HTML-embedded scripting language, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-1286     Stefan Esser discovered an overflow in the object     reference handling code of the unserialize() function,     which allows the execution of arbitrary code if     malformed input is passed from an application.

  - CVE-2007-1375     Stefan Esser discovered that an integer overflow in the     substr_compare() function allows information disclosure     of heap memory.

  - CVE-2007-1376     Stefan Esser discovered that insufficient validation of     shared memory functions allows the disclosure of heap     memory.

  - CVE-2007-1380     Stefan Esser discovered that the session handler     performs insufficient validation of variable name length     values, which allows information disclosure through a     heap information leak.

  - CVE-2007-1453     Stefan Esser discovered that the filtering framework     performs insufficient input validation, which allows the     execution of arbitrary code through a buffer underflow.

  - CVE-2007-1454     Stefan Esser discovered that the filtering framework can     be bypassed with a special whitespace character.

  - CVE-2007-1521     Stefan Esser discovered a double free vulnerability in     the session_regenerate_id() function, which allows the     execution of arbitrary code.

  - CVE-2007-1583     Stefan Esser discovered that a programming error in the     mb_parse_str() function allows the activation of     'register_globals'.

  - CVE-2007-1700     Stefan Esser discovered that the session extension     incorrectly maintains the reference count of session     variables, which allows the execution of arbitrary code.

  - CVE-2007-1711     Stefan Esser discovered a double free vulnerability in     the session management code, which allows the execution     of arbitrary code.

  - CVE-2007-1718     Stefan Esser discovered that the mail() function     performs insufficient validation of folded mail headers,     which allows mail header injection.

  - CVE-2007-1777     Stefan Esser discovered that the extension to handle ZIP     archives performs insufficient length checks, which     allows the execution of arbitrary code.

  - CVE-2007-1824     Stefan Esser discovered an off-by-one error in the     filtering framework, which allows the execution of     arbitrary code.

  - CVE-2007-1887     Stefan Esser discovered that a buffer overflow in the     sqlite extension allows the execution of arbitrary code.

  - CVE-2007-1889     Stefan Esser discovered that the PHP memory manager     performs an incorrect type cast, which allows the     execution of arbitrary code through buffer overflows.

  - CVE-2007-1900     Stefan Esser discovered that incorrect validation in the     email filter extension allows the injection of mail     headers.

The oldstable distribution (sarge) doesn't include php5.

A heap-based buffer overflow vulnerability was found in PHP's gd extension. A script that could be forced to process WBMP images from an untrusted source could result in arbitrary code execution (CVE-2007-1001).

A DoS flaw was found in how PHP processed a deeply nested array. A remote attacker could cause the PHP intrerpreter to creash by submitting an input variable with a deeply nested array (CVE-2007-1285).

A vulnerability in the way the mbstring extension set global variables was discovered where a script using the mb_parse_str() function to set global variables could be forced to to enable the register_globals configuration option, possibly resulting in global variable injection (CVE-2007-1583).

A vulnerability in how PHP's mail() function processed header data was discovered. If a script sent mail using a subject header containing a string from an untrusted source, a remote attacker could send bulk email to unintended recipients (CVE-2007-1718).

A buffer overflow in the sqlite_decode_function() in the bundled sqlite library could allow context-dependent attackers to execute arbitrary code (CVE-2007-1887).

Updated packages have been patched to correct these issues. Also note that the default use of the Hardened PHP patch helped to protect against some of these issues prior to patching.

According to its banner, the version of PHP installed on the remote host is older than 5.2.1.  Such versions may be affected by several issues, including buffer overflows, format string vulnerabilities, arbitrary code execution, 'safe_mode' and 'open_basedir' bypasses, and clobbering of super-globals.

Stefan Esser discovered multiple vulnerabilities in the 'Month of PHP bugs'.

The substr_compare() function did not sufficiently verify its length argument. This might be exploited to read otherwise unaccessible memory, which might lead to information disclosure. (CVE-2007-1375)

The shared memory (shmop) functions did not verify resource types, thus they could be called with a wrong resource type that might contain user-supplied data. This could be exploited to read and write arbitrary memory addresses of the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1376)

The php_binary handler of the session extension was missing a boundary check. When unserializing overly long variable names this could be exploited to read up to 126 bytes of memory, which might lead to information disclosure. (CVE-2007-1380)

The internal array_user_key_compare() function, as used for example by the PHP function uksort(), incorrectly handled memory unreferencing of its arguments. This could have been exploited to execute arbitrary code with the privileges of the PHP interpreter, and thus circumventing any disable_functions, open_basedir, or safe_mode restrictions. (CVE-2007-1484)

The session_regenerate_id() function did not properly clean up the former session identifier variable. This could be exploited to crash the PHP interpreter, possibly also remotely. (CVE-2007-1521)

Under certain conditions the mb_parse_str() could cause the register_globals configuration option to become permanently enabled.
This opened an attack vector for a large and common class of vulnerabilities. (CVE-2007-1583)

The session extension did not set the correct reference count value for the session variables. By unsetting _SESSION and HTTP_SESSION_VARS (or tricking a PHP script into doing that) this could be exploited to execute arbitrary code with the privileges of the PHP interpreter.
This issue does not affect Ubuntu 7.04. (CVE-2007-1700)

The mail() function did not correctly escape control characters in multiline email headers. This could be remotely exploited to inject arbitrary email headers. (CVE-2007-1718)

The php_stream_filter_create() function had an off-by-one buffer overflow in the handling of wildcards. This could be exploited to remotely crash the PHP interpreter. This issue does not affect Ubuntu 7.04. (CVE-2007-1824)

When calling the sqlite_udf_decode_binary() with special arguments, a buffer overflow happened. Depending on the application this could be locally or remotely exploited to execute arbitrary code with the privileges of the PHP interpreter. (CVE-2007-1887 CVE-2007-1888)

The FILTER_VALIDATE_EMAIL filter extension used a wrong regular expression that allowed injecting a newline character at the end of the email string. This could be exploited to inject arbitrary email headers. This issue only affects Ubuntu 7.04. (CVE-2007-1900).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest release of PHP 5.2.

A number of security issues have been fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running PHP less than 5.2.0.  This version is vulnerable to around 180 bugs.  An attacker exploiting these flaws would be able to impact confidentiality, integrity, and availability. 

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
26942	GLSA-200710-02 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2007/10/9	2021/1/6	high
24907	PHP < 5.2.1 の複数の脆弱性	Nessus	CGI abuses	2007/4/2	2025/5/26	high
24906	PHP < 4.4.5 の複数の脆弱性	Nessus	CGI abuses	2007/4/2	2025/5/26	high
25368	PHP < 5.2.3 Multiple Vulnerabilities	Nessus	CGI abuses	2007/6/2	2025/5/26	high
24907	PHP < 5.2.1 多種弱點	Nessus	CGI abuses	2007/4/2	2025/5/26	high
24906	PHP < 4.4.5 多種弱點	Nessus	CGI abuses	2007/4/2	2025/5/26	high
25368	PHP < 5.2.3 の複数の脆弱性	Nessus	CGI abuses	2007/6/2	2025/5/26	high
24907	PHP < 5.2.1 多种漏洞	Nessus	CGI abuses	2007/4/2	2025/5/26	high
25368	PHP < 5.2.3 多種弱點	Nessus	CGI abuses	2007/6/2	2025/5/26	high
25368	PHP < 5.2.3 多种漏洞	Nessus	CGI abuses	2007/6/2	2025/5/26	high
24906	PHP < 4.4.5 多种漏洞	Nessus	CGI abuses	2007/4/2	2025/5/26	high
24906	PHP < 4.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	2007/4/2	2025/5/26	high
25100	Debian DSA-1283-1 : php5 - several vulnerabilities	Nessus	Debian Local Security Checks	2007/4/30	2021/1/4	high
25113	Mandrake Linux Security Advisory : php (MDKSA-2007:089)	Nessus	Mandriva Local Security Checks	2007/4/30	2021/1/6	high
24907	PHP < 5.2.1 Multiple Vulnerabilities	Nessus	CGI abuses	2007/4/2	2025/5/26	high
28053	Ubuntu 6.06 LTS / 6.10 / 7.04 : php5 vulnerabilities (USN-455-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
27759	Fedora 7 : php-5.2.4-1.fc7 (2007-2215)	Nessus	Fedora Local Security Checks	2007/11/6	2021/1/11	high
3857	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2007/2/9	2019/3/6	medium
801112	PHP < 4.4.5 / 5.2.1 Multiple Vulnerabilities	Log Correlation Engine	Web Servers			high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium

high