acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query.

According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.30. It is, therefore, affected by the following vulnerabilities :

  - Boundary checking errors exist related to the     Fileinfo extension, Composite Document Format (CDF)     handling and the functions 'cdf_read_short_sector',     'cdf_check_stream_offset', 'cdf_count_chain', and     'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479,     CVE-2014-3480, CVE-2014-3487)

  - A pascal string size handling error exists related to     the Fileinfo extension and the function 'mconvert'.
    (CVE-2014-3478)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - A type-confusion error exists related to the function     'php_print_info' that could allow disclosure of     sensitive information. (CVE-2014-4721)

  - An out-of-bounds read error exists in the     timelib_meridian_with_check() function due to a failure     to properly check string ends. A remote attacker can     exploit this to cause a denial of service condition or     to disclose memory contents.

  - An out-of-bounds read error exists in the     date_parse_from_format() function due to a failure     in the date parsing routines to properly check string     ends. A remote attacker can exploit this to cause a     denial of service condition or to disclose memory     contents.

  - An error exists related to unserialization and     'SplFileObject' handling that could allow denial of     service attacks. (Bug #67072)

  - A double free error exists related to the Intl     extension and the method 'Locale::parseLocale' having     unspecified impact. (Bug #67349)

  - A buffer overflow error exists related to the Intl     extension and the functions 'locale_get_display_name'     and 'uloc_getDisplayName' having unspecified impact.
    (Bug #67397)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

The PHP Team reports :

insecure temporary file use in the configure script

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

Heap buffer over-read in DateInterval

fileinfo: cdf_read_short_sector insufficient boundary check

fileinfo: CDF infinite loop in nelements DoS

fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)

Fix potential segfault in dns_check_record()

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.29. It is, therefore, affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to handling     DateInterval objects that allows denial of service     attacks. (CVE-2013-6712)

  - A boundary checking error exists related to the Fileinfo     extension, Composite Document Format (CDF) handling, and     the function 'cdf_read_short_sector'. (CVE-2014-0207)

  - A flaw exists with the 'cdf_unpack_summary_info()'     function within 'src/cdf.c' where multiple file_printf     calls occur when handling specially crafted CDF files.
    This could allow a context dependent attacker to crash     the web application using PHP. (CVE-2014-0237)

  - A flaw exists with the 'cdf_read_property_info()'     function within 'src/cdf.c' where an infinite loop     occurs when handling specially crafted CDF files. This     could allow a context dependent attacker to crash the     web application using PHP. (CVE-2014-0238)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - An out-of-bounds read exists in printf. (Bug #67249)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

Additionally, note that version 5.3.29 marks the end of support for the PHP 5.3.x branch.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
78310	Amazon Linux AMI : php54 (ALAS-2014-367)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	high
78315	Amazon Linux AMI : php55 (ALAS-2014-372)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	high
78556	PHP 5.6.0 Multiple Vulnerabilities	Nessus	CGI abuses	2014/10/17	2025/5/26	high
76476	Slackware 14.0 / 14.1 / current : php (SSA:2014-192-01)	Nessus	Slackware Local Security Checks	2014/7/14	2021/1/14	high
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/8/30	2021/1/6	high
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical
76281	PHP 5.4.x < 5.4.30 Multiple Vulnerabilities	Nessus	CGI abuses	2014/6/27	2025/5/26	high
77241	FreeBSD : PHP multiple vulnerabilities (d2a892b9-2605-11e4-9da0-00a0986f28c4)	Nessus	FreeBSD Local Security Checks	2014/8/19	2021/1/6	high
77285	PHP 5.3.x < 5.3.29 Multiple Vulnerabilities	Nessus	CGI abuses	2014/8/20	2025/5/26	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high