This update for php5 fixes the following security issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2952-1 fixed vulnerabilities in PHP. One of the backported patches caused a regression in the PHP Soap client. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories.
(CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8835, CVE-2016-3185)

It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases. A man in the middle attacker could possibly use this issue to downgrade and snoop on TLS connections. This vulnerability is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2016-3142)

It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When running under PHP-FPM, this could result in XML external entity injection and entity expansion issues.
This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically strong pseudo-random bytes. (No CVE number)

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE number pending)

It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is 10.11.x prior to 10.11.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - AMD
  - apache_mod_php
  - AppleGraphicsControl
  - AppleGraphicsPowerManagement
  - Assistant
  - ATS
  - Audio
  - Captive
  - CFNetwork
  - CommonCrypto
  - CoreCapture
  - CoreStorage
  - Crash
  - Disk
  - Disk
  - Driver
  - Drivers
  - Drivers
  - Graphics
  - Graphics
  - Graphics
  - ImageIO
  - Images
  - Intel
  - IOAcceleratorFamily
  - IOAudioFamily
  - IOFireWireFamily
  - IOHIDFamily
  - Kernel
  - libc
  - libxml2
  - libxslt
  - Lock
  - MapKit
  - Messages
  - Multi-Touch
  - Network
  - NVIDIA
  - OpenGL
  - Proxies
  - QuickTime
  - Reporter
  - SceneKit
  - Screen
  - Tcl
  - Utility

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

  - CVE-2016-2554 Stack-based buffer overflow in     ext/phar/tar.c allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a crafted TAR archive.

  - CVE-2016-3141 Use-after-free vulnerability in wddx.c in     the WDDX extension allows remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact by     triggering a wddx_deserialize call on XML data     containing a crafted var element.

  - CVE-2016-3142 The phar_parse_zipfile function in zip.c     in the PHAR extension in PHP before 5.5.33 and 5.6.x     before 5.6.19 allows remote attackers to obtain     sensitive information from process memory or cause a     denial of service (out-of-bounds read and application     crash) by placing a PK\x05\x06 signature at an invalid     location.

  - CVE-2016-4342 ext/phar/phar_object.c in PHP before     5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3     mishandles zero-length uncompressed data, which allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other     impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.

  - CVE-2016-9934 ext/wddx/wddx.c in PHP before 5.6.28 and     7.x before 7.0.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.

  - CVE-2016-9935 The php_wddx_push_element function in     ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before     7.0.14 allows remote attackers to cause a denial of     service (out-of-bounds read and memory corruption) or     possibly have unspecified other impact via an empty     boolean element in a wddxPacket XML document.

  - CVE-2016-10158 The exif_convert_any_to_int function in     ext/exif/exif.c in PHP before 5.6.30, 7.0.x before     7.0.15, and 7.1.x before 7.1.1 allows remote attackers     to cause a denial of service (application crash) via     crafted EXIF data that triggers an attempt to divide the     minimum representable negative integer by -1.

  - CVE-2016-10159 Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     consumption or application crash) via a truncated     manifest entry in a PHAR archive.

  - CVE-2016-10160 Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via a     crafted PHAR archive with an alias mismatch.

  - CVE-2016-10161 The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data call.

  - BUG-71323.patch Output of stream_get_meta_data can be     falsified by its input

  - BUG-70979.patch Crash on bad SOAP request

  - BUG-71039.patch exec functions ignore length but look     for NULL termination

  - BUG-71459.patch Integer overflow in iptcembed()

  - BUG-71391.patch NULL pointer Dereference in     phar_tar_setupmetadata()

  - BUG-71335.patch Type confusion vulnerability in WDDX     packet deserialization

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u7.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.33. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when handling XML     data. An unauthenticated, remote attacker can exploit     this, via crafted XML data, to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-3141)

  - An out-of-bounds read error exists in file     ext/phar/zip.c in the phar_parse_zipfile() function that     allows an unauthenticated, remote attacker to cause a     denial of service or to gain access to sensitive     information. (CVE-2016-3142)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following security issues :

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s_call method suffered from a     type confusion issue that could have lead to crashes     [bsc#973351]

  - CVE-2016-2554: A NULL pointer dereference in     phar_get_fp_offset could lead to crashes. [bsc#968284]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]     Note: we do not ship the phar extension currently, so we     are not affected.

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

This update was imported from the SUSE:SLE-12:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before     5.6.19 allows remote attackers to obtain sensitive information from process memory or cause a denial of     service (out-of-bounds read and application crash) by placing a PK\x05\x06 signature at an invalid     location. (CVE-2016-3142)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2952-1 advisory.

    It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip     files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767)

    It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-8835, CVE-2016-3185)

    It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases.
    A machine-in-the-middle attacker could possibly use this issue to downgrade and snoop on TLS connections.
    This vulnerability is known as BACKRONYM. (CVE-2015-8838)

    It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information.
    This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903)

    Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2016-2554)

    It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-3141)

    It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive     information. (CVE-2016-3142)

    It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When     running under PHP-FPM, this could result in XML external entity injection and entity expansion issues.
    This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

    It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically     strong pseudo-random bytes. (No CVE number)

    It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

    It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE number pending)

    It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number     pending)

    It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

    It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.19. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when handling XML     data. An unauthenticated, remote attacker can exploit     this, via crafted XML data, to dereference already freed     memory, resulting in the execution of arbitrary code.
    (CVE-2016-3141)

  - An out-of-bounds read error exists in file     ext/phar/zip.c in the phar_parse_zipfile() function that     allows an unauthenticated, remote attacker to cause a     denial of service or to gain access to sensitive     information. (CVE-2016-3142)

  - A NULL pointer dereference flaw exists in file     ext/xsl/xsltprocessor.c in the xsl_ext_function_php()     function that allows an unauthenticated, remote attacker     to cause a denial of service.

  - A flaw exists in file sapi/cli/php_cli_server.c due to     the built-in HTTP server not properly restricting file     requests. An unauthenticated, remote attacker can     exploit this to access arbitrary files.

  - A use-after-free error exists in Zend Opcache when     updating cached directory names that have been cached in     the current working directory. An unauthenticated,     remote attacker can exploit this to deference already     freed memory, resulting in the execution of arbitrary     code.

  - A NULL pointer dereference flaw exists in file     ext/zip/php_zip.c in the Zip::ExtractTo() method that     allows an unauthenticated, remote attacker to cause     a denial of service.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following security issues :

  - bsc#974305: buffer overflow in libmagic 

  - CVE-2015-8838: mysqlnd was vulnerable to BACKRONYM     (bnc#973792).

  - CVE-2015-8835: SoapClient s__call method suffered from     type confusion issue (bnc#973351).

  - CVE-2016-3141: A use-after-free / double-free in the     WDDX deserialization could lead to crashes or potential     code execution. [bsc#969821]

  - CVE-2016-3142: An Out-of-bounds read in     phar_parse_zipfile() could lead to crashes. [bsc#971912]

  - CVE-2014-9767: A directory traversal when extracting zip     files was fixed that could lead to overwritten files.
    [bsc#971612]

  - CVE-2016-3185: A type confusion vulnerability in     make_http_soap_request() could lead to crashes or     potentially code execution. [bsc#971611]

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
132184	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	Nessus	Huawei Local Security Checks	2019/12/18	2023/4/25	critical
119975	SUSE SLES12 Security Update : php5 (SUSE-SU-2016:1166-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
90825	Ubuntu 15.10 : php5 regression (USN-2952-2)	Nessus	Ubuntu Local Security Checks	2016/5/2	2023/1/12	critical
91228	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
97052	Debian DLA-818-1 : php5 security update	Nessus	Debian Local Security Checks	2017/2/8	2026/1/1	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical
90007	PHP 5.5.x < 5.5.33 Multiple Vulnerabilities	Nessus	CGI abuses	2016/3/17	2025/5/26	critical
90782	openSUSE Security Update : php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
219602	Linux Distros Unpatched Vulnerability : CVE-2016-3142	Nessus	Misc.	2025/3/4	2025/8/21	high
90677	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2952-1)	Nessus	Ubuntu Local Security Checks	2016/4/22	2024/8/27	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	2020/7/1	2023/4/25	critical
90008	PHP 5.6.x < 5.6.19 Multiple Vulnerabilities	Nessus	CGI abuses	2016/3/17	2025/5/26	critical
90772	openSUSE Security Update : php5 (openSUSE-2016-516)	Nessus	SuSE Local Security Checks	2016/4/28	2021/1/19	critical

检测

插件搜索

critical

critical

critical

high

critical

critical

critical

critical

high

critical

critical

critical

critical