According to its self-reported version number, the remote pfSense install is prior to 2.2.4. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.27. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability, known as     'BACKRONYM', exists due to a failure to properly enforce     the requirement of an SSL/TLS connection when the --ssl     client option is used. A man-in-the-middle attacker can     exploit this flaw to coerce the client to downgrade to     an unencrypted connection, allowing the attacker to     disclose data from the database or manipulate database     queries. (CVE-2015-3152)

  - A flaw in the phar_convert_to_other function in     ext/phar/phar_object.c could allow a remote attacker     to cause a denial of service. (CVE-2015-5589)

  - A Stack-based buffer overflow in the phar_fix_filepath     function in ext/phar/phar.c could allow a remote attacker     to cause a denial of service. (CVE-2015-5590)

  - A flaw exists in the PHP Connector/C component due to a     failure to properly enforce the requirement of an     SSL/TLS connection when the --ssl client option is used.
    A man-in-the-middle attacker can exploit this to     downgrade the connection to plain HTTP when HTTPS is     expected. (CVE-2015-8838)

  - An unspecified flaw exists in the     phar_convert_to_other() function in phar_object.c during     the conversion of invalid TAR files. An attacker can     exploit this flaw to crash a PHP application, resulting     in a denial of service condition.

  - The '!' character is not treated as a special character     when delayed variable substitution is enabled. The     functions escapeshellcmd() and escapeshellarg() are     unable to properly sanitize arguments containing '!'.
    An attacker can exploit this to execute arbitrary     commands.

  - A double-free flaw exists in zend_vm_execute.h due to     improper handling of certain code. An attacker can     exploit this flaw to crash a PHP application, resulting     in a denial of service condition.

  - A flaw exists in the parse_ini_file() and     parse_ini_string() functions due to improper handling of     strings that contain a line feed followed by an escape     character. An attacker can exploit this to crash a PHP     application, resulting in a denial of service condition.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x     before 5.5.27, and 5.6.x before 5.6.11 uses a client     SSL option to mean that SSL is optional, which allows     man-in-the-middle attackers to spoof servers via a     cleartext-downgrade attack, a related issue to     CVE-2015-3152.(CVE-2015-8838)

  - In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14     and 8.0.0, when validating URL with functions like     filter_var($url, FILTER_VALIDATE_URL), PHP will accept     an URL with invalid password as valid URL. This may     lead to functions that rely on URL being valid to     mis-parse the URL and produce wrong data as components     of the URL.(CVE-2020-7071)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

This update was imported from the SUSE:SLE-12:Update update project.

This update for php53 fixes the following issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961] Note: we do not ship the     phar extension currently, so we are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php53 fixes the following issues :

  - CVE-2016-5093: A get_icu_value_internal out-of-bounds     read could crash the php interpreter (bsc#982010)

  - CVE-2016-5094,CVE-2016-5095: Don't allow creating     strings with lengths outside int range, avoids overflows     (bsc#982011,bsc#982012)

  - CVE-2016-5096: A int/size_t confusion in fread could     corrupt memory (bsc#982013)

  - CVE-2016-5114: A fpm_log.c memory leak and buffer     overflow could leak information out of the php process     or overwrite a buffer by 1 byte (bsc#982162)

  - CVE-2016-4346: A heap overflow was fixed in     ext/standard/string.c (bsc#977994)

  - CVE-2016-4342: A heap corruption was fixed in     tar/zip/phar parser (bsc#977991)

  - CVE-2016-4537, CVE-2016-4538: bcpowmod accepted negative     scale causing heap buffer overflow corrupting _one_     definition (bsc#978827)

  - CVE-2016-4539: Malformed input causes segmentation fault     in xml_parse_into_struct() function (bsc#978828)

  - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read     in zif_grapheme_stripos when given negative offset     (bsc#978829)

  - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544:
    Out-of-bounds heap memory read in exif_read_data()     caused by malformed input (bsc#978830)

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function (bsc#980366)

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c (bsc#980373)

  - CVE-2015-8874: Stack consumption vulnerability in GD     (bsc#980375)

  - CVE-2015-8879: odbc_bindcols function in     ext/odbc/php_odbc.c mishandles driver behavior for     SQL_WVARCHAR (bsc#981050)

Also fixed previously on SUSE Linux Enterprise 11 SP4, but not yet shipped to SUSE Linux Enterprise Server 11 SP3 LTSS :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]

  - CVE-2015-7803: A Stack overflow vulnerability when     decompressing tar phar archives could potentially lead     to code execution. [bsc#949961]

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

  - CVE-2016-4073: A remote attacker could have caused     denial of service, or possibly execute arbitrary code,     due to incorrect handling of string length calculations     in mb_strcut() (bsc#977003)

  - CVE-2015-8867: The PHP function     openssl_random_pseudo_bytes() did not return     cryptographically secure random bytes (bsc#977005)

  - CVE-2016-4070: The libxml_disable_entity_loader()     setting was shared between threads, which could have     resulted in XML external entity injection and entity     expansion issues (bsc#976997)

  - CVE-2015-8866: A remote attacker could have caused     denial of service due to incorrect handling of large     strings in php_raw_url_encode() (bsc#976996)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.43. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability, known as     'BACKRONYM', exists due to a failure to properly enforce     the requirement of an SSL/TLS connection when the --ssl     client option is used. A man-in-the-middle attacker can     exploit this flaw to coerce the client to downgrade to     an unencrypted connection, allowing the attacker to     disclose data from the database or manipulate database     queries. (CVE-2015-3152)

  - A flaw in the phar_convert_to_other function in     ext/phar/phar_object.c could allow a remote attacker     to cause a denial of service. (CVE-2015-5589)

  - A Stack-based buffer overflow in the phar_fix_filepath     function in ext/phar/phar.c could allow a remote attacker     to cause a denial of service. (CVE-2015-5590)

  - A flaw exists in the PHP Connector/C component due to a     failure to properly enforce the requirement of an     SSL/TLS connection when the --ssl client option is used.
    A man-in-the-middle attacker can exploit this to     downgrade the connection to plain HTTP when HTTPS is     expected. (CVE-2015-8838)     
  - An unspecified flaw exists in the     phar_convert_to_other() function in phar_object.c during     the conversion of invalid TAR files. An attacker can     exploit this flaw to crash a PHP application, resulting     in a denial of service condition.

  - A flaw exists in the parse_ini_file() and     parse_ini_string() functions due to improper handling of     strings that contain a line feed followed by an escape     character. An attacker can exploit this to crash a PHP     application, resulting in a denial of service condition.

  - A user-after-free error exists in the object_custom()     function in var_unserializer.c due to improper     validation of user-supplied input. A remote attacker can     exploit this to dereference already freed memory,     potentially resulting in the execution of arbitrary     code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following security issues :

  - bsc#974305: buffer overflow in libmagic 

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s__call method suffered from     type confusion issue (bnc#973351).

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
106496	pfSense < 2.2.4 Multiple Vulnerabilities (SA-15_07)	Nessus	Firewalls	2018/1/31	2025/11/20	medium
84672	PHP 5.5.x < 5.5.27 Multiple Vulnerabilities (BACKRONYM)	Nessus	CGI abuses	2015/7/10	2025/5/26	critical
149163	EulerOS 2.0 SP3 : php (EulerOS-SA-2021-1830)	Nessus	Huawei Local Security Checks	2021/4/30	2025/2/20	medium
90782	openSUSE Security Update : php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
90757	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1145-1)	Nessus	SuSE Local Security Checks	2016/4/27	2021/1/19	critical
91665	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
84671	PHP 5.4.x < 5.4.43 Multiple Vulnerabilities (BACKRONYM)	Nessus	CGI abuses	2015/7/10	2025/5/26	critical
90772	openSUSE Security Update : php5 (openSUSE-2016-516)	Nessus	SuSE Local Security Checks	2016/4/28	2021/1/19	critical

检测

插件搜索

medium

critical

medium

critical

critical

critical

critical

critical

critical