PHP developers reports :

This release focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.12 :

- Fixed a safe_mode bypass in tempnam() identified by Grzegorz Stachowiak. (CVE-2009-3557, Rasmus)

- Fixed a open_basedir bypass in posix_mkfifo() identified by Grzegorz Stachowiak. (CVE-2009-3558, Rasmus)

- Added 'max_file_uploads' INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion, identified by Bogdan Calin. (CVE-2009-4017, Ilia)

- Added protection for $_SESSION from interrupt corruption and improved 'session.save_path' check, identified by Stefan Esser.
(CVE-2009-4143, Stas)

- Fixed bug #49785 (insufficient input string validation of htmlspecialchars()). (CVE-2009-4142, Moriyoshi, hello at iwamot dot com)

Update to the latest PHP 5.2 release which focuses on improving the stability of the PHP 5.2.x branch with over 60 bug fixes, some of which are security related. All users of PHP 5.2 are encouraged to upgrade to this release. See http://www.php.net/releases/5_2_12.php for more details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0040 advisory.

    - add security fix for CVE-2009-4142 (#543469)
    - add security fixes for CVE-2009-2687, CVE-2009-3291, CVE-2009-3292,       CVE-2009-3546 CVE-2009-4017 (#541597)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-78:01 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write     dynamically generated webpages. PHP also offers built-in database integration for several commercial and     non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly     simple. The most common use of PHP coding is probably as a replacement for CGI scripts.
    The php package contains the module which adds support for the PHP language to Apache HTTP Server.
    Security issues fixed with this release:
    CVE-2009-2687     The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a     denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than     CVE-2005-3353.
    CVE-2009-3291     The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform     certificate validation, which has unknown impact and attack vectors, probably related to an ability to     spoof certificates.
    CVE-2009-3292     Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before 5.3.1, has unknown impact and attack     vectors related to 'missing sanity checks around exif processing.'     CVE-2009-3546     The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library     2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers     to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability     than CVE-2009-3293. NOTE: some of these details are obtained from third party information.
    CVE-2009-4017     PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when     handling a multipart/form-data POST request, which allows remote attackers to cause a denial of service     (resource exhaustion), and makes it easier for remote attackers to exploit local file inclusion     vulnerabilities, via multiple requests, related to lack of support for the max_file_uploads directive.
    CVE-2009-4142     The htmlspecialchars function in PHP before 5.2.12 does not properly handle (1) overlong UTF-8 sequences,     (2) invalid Shift_JIS sequences, and (3) invalid EUC-JP sequences, which allows remote attackers to     conduct cross-site scripting (XSS) attacks by placing a crafted byte sequence before a special character.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

This update of PHP5 fixes :

  - CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P) : Permissions, Privileges,     and Access Control (CWE-264)

  - Cross-Site Scripting (XSS). (CWE-79). (CVE-2008-5814:
    CVSS v2 Base Score: 2.6 (LOW)     (AV:N/AC:H/Au:N/C:N/I:P/A:N))

  - CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P) : Other (CWE-Other)

  - CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P) : Input Validation (CWE-20)

  - CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P) : Other (CWE-Other)

  - CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P) : Other (CWE-Other)

  - Cross-Site Scripting (XSS) (CWE-79). (CVE-2009-4142:
    CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N))

This update of php5 fixes: CVE-2008-5624: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges, and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS v2 Base Score: 6.4 (MEDIUM) (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other) CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20) CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate) (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other) CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate) (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other) CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting (XSS) (CWE-79)

This update of PHP5 fixes :

  - CVE-2008-5625: CVSS v2 Base Score: 7.5 (HIGH)     (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions, Privileges,     and Access Control (CWE-264) CVE-2008-5814: CVSS v2 Base     Score: 2.6 (LOW) (AV:N/AC:H/Au:N/C:N/I:P/A:N):
    Cross-Site Scripting (XSS) (CWE-79) CVE-2009-2626: CVSS     v2 Base Score: 6.4 (MEDIUM)     (AV:N/AC:L/Au:N/C:P/I:N/A:P): Other (CWE-Other)     CVE-2009-2687: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:N/A:P): Input Validation (CWE-20)     CVE-2009-3546: CVSS v2 Base Score: 4.4 (moderate)     (AV:L/AC:M/Au:N/C:P/I:P/A:P): Other (CWE-Other)     CVE-2009-4017: CVSS v2 Base Score: 5.0 (moderate)     (AV:N/AC:L/Au:N/C:N/I:N/A:P): Other (CWE-Other)     CVE-2009-4142: CVSS v2 Base Score: 4.3 (MEDIUM)     (AV:N/AC:M/Au:N/C:N/I:P/A:N): Cross-Site Scripting     (XSS). (CWE-79). (CVE-2008-5624: CVSS v2 Base Score: 7.5     (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P): Permissions,     Privileges, and Access Control (CWE-264))

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
43342	FreeBSD : php -- multiple vulnerabilities (39a25a63-eb5c-11de-b650-00215c6a37bb)	Nessus	FreeBSD Local Security Checks	2009/12/18	2021/1/6	critical
47186	Fedora 11 : maniadrive-1.2-17.fc11 / php-5.2.12-1.fc11 (2010-0495)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	high
67986	Oracle Linux 5 : php (ELSA-2010-0040)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
283975	MiracleLinux 3 : php-5.1.6-24.5.1.AXS3 (AXSA:2010-78:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	medium
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
44686	SuSE 11 Security Update : PHP5 (SAT Patch Number 1978)	Nessus	SuSE Local Security Checks	2010/2/23	2021/1/14	high
44683	openSUSE Security Update : apache2-mod_php5 (apache2-mod_php5-1993)	Nessus	SuSE Local Security Checks	2010/2/23	2021/1/14	high
49829	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 6847)	Nessus	SuSE Local Security Checks	2010/10/11	2021/1/14	high

检测

插件搜索

critical

high

medium

medium

critical

high

high

high