Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

  - CVE-2016-2554 Stack-based buffer overflow in     ext/phar/tar.c allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a crafted TAR archive.

  - CVE-2016-3141 Use-after-free vulnerability in wddx.c in     the WDDX extension allows remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact by     triggering a wddx_deserialize call on XML data     containing a crafted var element.

  - CVE-2016-3142 The phar_parse_zipfile function in zip.c     in the PHAR extension in PHP before 5.5.33 and 5.6.x     before 5.6.19 allows remote attackers to obtain     sensitive information from process memory or cause a     denial of service (out-of-bounds read and application     crash) by placing a PK\x05\x06 signature at an invalid     location.

  - CVE-2016-4342 ext/phar/phar_object.c in PHP before     5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3     mishandles zero-length uncompressed data, which allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other     impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.

  - CVE-2016-9934 ext/wddx/wddx.c in PHP before 5.6.28 and     7.x before 7.0.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.

  - CVE-2016-9935 The php_wddx_push_element function in     ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before     7.0.14 allows remote attackers to cause a denial of     service (out-of-bounds read and memory corruption) or     possibly have unspecified other impact via an empty     boolean element in a wddxPacket XML document.

  - CVE-2016-10158 The exif_convert_any_to_int function in     ext/exif/exif.c in PHP before 5.6.30, 7.0.x before     7.0.15, and 7.1.x before 7.1.1 allows remote attackers     to cause a denial of service (application crash) via     crafted EXIF data that triggers an attempt to divide the     minimum representable negative integer by -1.

  - CVE-2016-10159 Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     consumption or application crash) via a truncated     manifest entry in a PHAR archive.

  - CVE-2016-10160 Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via a     crafted PHAR archive with an alias mismatch.

  - CVE-2016-10161 The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data call.

  - BUG-71323.patch Output of stream_get_meta_data can be     falsified by its input

  - BUG-70979.patch Crash on bad SOAP request

  - BUG-71039.patch exec functions ignore length but look     for NULL termination

  - BUG-71459.patch Integer overflow in iptcembed()

  - BUG-71391.patch NULL pointer Dereference in     phar_tar_setupmetadata()

  - BUG-71335.patch Type confusion vulnerability in WDDX     packet deserialization

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u7.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ext/standard/var_unserializer.c in PHP before 5.6.25     and 7.x before 7.0.10 mishandles certain invalid     objects, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via crafted serialized data that leads to a (1)
    __destruct call or (2) magic method     call.(CVE-2016-7124)

  - Stack-based buffer overflow in ext/phar/tar.c in PHP     before 5.5.32, 5.6.x before 5.6.18, and 7.x before     7.0.3 allows remote attackers to cause a denial of     service (application crash) or possibly have     unspecified other impact via a crafted TAR     archive.(CVE-2016-2554)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6831)

  - The sapi_header_op function in main/SAPI.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before     5.6.6 supports deprecated line folding without     considering browser compatibility, which allows remote     attackers to conduct cross-site scripting (XSS) attacks     against Internet Explorer by leveraging (1) %0A%20 or     (2) %0D%0A%20 mishandling in the header     function.(CVE-2015-8935)

  - The openssl_random_pseudo_bytes function in     ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 incorrectly     relies on the deprecated RAND_pseudo_bytes function,     which makes it easier for remote attackers to defeat     cryptographic protection mechanisms via unspecified     vectors.(CVE-2015-8867)

  - Use-after-free vulnerability in the SPL unserialize     implementation in ext/spl/spl_array.c in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12     allows remote attackers to execute arbitrary code via     crafted serialized data that triggers misuse of an     array field.(CVE-2015-6832)

  - Directory traversal vulnerability in the PharData class     in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x     before 5.6.12 allows remote attackers to write to     arbitrary files via a .. (dot dot) in a ZIP archive     entry that is mishandled during an extractTo     call.(CVE-2015-6833)

  - Directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c in     PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x     before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before     3.12.1 allows remote attackers to create arbitrary     empty directories via a crafted ZIP     archive.(CVE-2014-9767)

  - The ZIP signature-verification feature in PHP before     5.6.26 and 7.x before 7.0.11 does not ensure that the     uncompressed_filesize field is large enough, which     allows remote attackers to cause a denial of service     (out-of-bounds memory access) or possibly have     unspecified other impact via a crafted PHAR archive,     related to ext/phar/util.c and     ext/phar/zip.c.(CVE-2016-7414)

  - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before     7.0.13 allows remote attackers to cause a denial of     service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.(CVE-2016-9934)

  - The php_wddx_push_element function in ext/wddx/wddx.c     in PHP before 5.6.29 and 7.x before 7.0.14 allows     remote attackers to cause a denial of service     (out-of-bounds read and memory corruption) or possibly     have unspecified other impact via an empty boolean     element in a wddxPacket XML document.(CVE-2016-9935)

  - In PHP before 5.6.31, an invalid free in the WDDX     deserialization of boolean parameters could be used by     attackers able to inject XML for deserialization to     crash the PHP interpreter, related to an invalid free     for an empty boolean element in     ext/wddx/wddx.c.(CVE-2017-11143)

  - Integer overflow in the php_html_entities function in     ext/standard/html.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact by     triggering a large output string from the     htmlspecialchars function.(CVE-2016-5094)

  - The get_icu_value_internal function in     ext/intl/locale/locale_methods.c in PHP before 5.5.36,     5.6.x before 5.6.22, and 7.x before 7.0.7 does not     ensure the presence of a '\0' character, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a crafted locale_get_primary_language     call.(CVE-2016-5093)

  - The grapheme_strpos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4541)

  - The exif_process_IFD_TAG function in ext/exif/exif.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 does not properly construct spprintf arguments,     which allows remote attackers to cause a denial of     service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4542)

  - The phar_parse_zipfile function in zip.c in the PHAR     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service     (out-of-bounds read and application crash) by placing a     PK\x05\x06 signature at an invalid     location.(CVE-2016-3142)

  - ** DISPUTED ** Integer overflow in the     php_raw_url_encode function in ext/standard/url.c in     PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before     7.0.5 allows remote attackers to cause a denial of     service (application crash) via a long string to the     rawurlencode function. NOTE: the vendor says 'Not sure     if this qualifies as security issue (probably     not).'(CVE-2016-4070)

  - The xml_parse_into_struct function in ext/xml/xml.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 allows remote attackers to cause a denial of     service (buffer under-read and segmentation fault) or     possibly have unspecified other impact via crafted XML     data in the second argument, leading to a parser level     of zero.(CVE-2016-4539)

  - The grapheme_stripos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4540)

  - Use-after-free vulnerability in wddx.c in the WDDX     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact by triggering a     wddx_deserialize call on XML data containing a crafted     var element.(CVE-2016-3141)

  - In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR     archive handler could be used by attackers supplying     malicious archive files to crash the PHP interpreter or     potentially disclose information due to a buffer     over-read in the phar_parse_pharfile function in     ext/phar/phar.c.(CVE-2017-11147)

  - The exif_process_IFD_in_JPEG function in     ext/exif/exif.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 does not validate IFD     sizes, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4543)

  - The odbc_bindcols function in ext/odbc/php_odbc.c in     PHP before 5.6.12 mishandles driver behavior for     SQL_WVARCHAR columns, which allows remote attackers to     cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table.(CVE-2015-8879)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write or read     occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not     handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression     containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in     next_state_val(), resulting in an out-of-bounds write     memory corruption.(CVE-2017-9226)

  - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x     before 7.1.7, the openssl extension PEM sealing code     did not check the return value of the OpenSSL sealing     function, which could lead to a crash of the PHP     interpreter, related to an interpretation conflict for     a negative number in ext/openssl/openssl.c, and an     OpenSSL documentation omission.(CVE-2017-11144)

  - The make_http_soap_request function in     ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before     5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service (type     confusion and application crash) via crafted serialized
    _cookies data, related to the SoapClient::__call method     in ext/soap/soap.c.(CVE-2016-3185)

  - The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data     call.(CVE-2016-10161)

  - The finish_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.6.31,     7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to     a buffer over-read while unserializing untrusted data.
    Exploitation of this issue can have an unspecified     impact on the integrity of PHP.(CVE-2017-12933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

此 php53 更新可修正下列問題：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2015-7803：解壓縮 tar phar 封存時存有一個堆疊溢位弱點，其可能導致程式碼執行。[bsc#949961] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

此 php5 更新可修正下列安全性問題：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912] 注意：我們目前沒有隨附 phar 延伸模組，因此，我們不會受到影響。

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

此更新是從 SUSE:SLE-12:Update 更新專案匯入。

遠端主機執行的 Mac OS X 10.11.x 版比 10.11.5 版舊。因此受到下列元件中的多個弱點影響：

- AMD
 - apache_mod_php
 - AppleGraphicsControl
 - AppleGraphicsPowerManagement
 - Assistant
 - ATS
 - Audio
 - Captive
 - CFNetwork
 - CommonCrypto
 - CoreCapture
 - CoreStorage
 - Crash
 - Disk
 - Disk
 - Driver
 - Drivers
 - Drivers
 - Graphics
 - Graphics
 - Graphics
 - ImageIO
 - Images
 - Intel
 - IOAcceleratorFamily
 - IOAudioFamily
 - IOFireWireFamily
 - IOHIDFamily
 - Kernel
 - libc
 - libxml2
 - libxslt
 - Lock
 - MapKit
 - Messages
 - Multi-Touch
 - Network
 - NVIDIA
 - OpenGL
 - Proxies
 - QuickTime
 - Reporter
 - SceneKit
 - Screen
 - Tcl
 - Utility

請注意，如果成功惡意利用多數嚴重問題，將會導致任意程式碼執行。

此 php53 更新可修正下列問題：

- CVE-2016-5093：一個 get_icu_value_internal 超出邊界讀取可能會損毀 php 解譯器 (bsc#982010)

- CVE-2016-5094、CVE-2016-5095：不允許建立長度超出 int 範圍的字串，以避免溢位 (bsc#982011、bsc#982012)

- CVE-2016-5096：fread 中的一個 int/size_t 混淆可造成損毀的記憶體 (bsc#982013)

- CVE-2016-5114：fpm_log.c 記憶體洩漏和緩衝區溢位可能會導致資訊洩漏至 php 處理程序之外，或覆寫緩衝區 1 個位元組 (bsc#982162)

- CVE-2016-4346：ext/standard/string.c 中的一個堆積溢位 (bsc#977994)

- CVE-2016-4342：修正了 tar/zip/phar 剖析器中的一個堆積損毀 (bsc#977991)

- CVE-2016-4537、CVE-2016-4538：bcpowmod 接受負比例而造成堆積緩衝區溢位，進而損毀 _one_ definition (bsc#978827)

- CVE-2016-4539：格式錯誤的輸入造成 xml_parse_into_struct() 函式中發生分割錯誤問題 (bsc#978828)

- CVE-2016-4540、CVE-2016-4541：指定負位移時 zif_grapheme_stripos 中發生超出邊界記憶體讀取問題 (bsc#978829)

- CVE-2016-4542、CVE-2016-4543、CVE-2016-4544：
格式錯誤的輸入造成 exif_read_data() 中發生超出邊界堆積記憶體讀取問題 (bsc#978830)

- CVE-2015-4116：spl_ptr_heap_insert 函式中有釋放後使用弱點 (bsc#980366)

- CVE-2015-8873：Zend/zend_exceptions.c 中有堆疊消耗弱點 (bsc#980373)

- CVE-2015-8874：GD 中有堆疊消耗弱點 (bsc#980375)

- CVE-2015-8879：ext/odbc/php_odbc.c 中的 dbc_bindcols 函式不當處理 SQL_WVARCHAR 的驅動程式行為 (bsc#981050)

之前也已在 SUSE Linux Enterprise 11 SP4 上修正，但尚未隨附於 SUSE Linux Enterprise Server 11 SP3 LTSS：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284]

- CVE-2015-7803：解壓縮 tar phar 封存時存有一個堆疊溢位弱點，其可能導致程式碼執行。[bsc#949961]

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912]

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

- CVE-2016-4073：由於錯誤處理 mb_strcut() 中的字串長度計算，遠端攻擊者可藉此造成拒絕服務，或可能執行任意程式碼 (bsc#977003)

- CVE-2015-8867：PHP 函式 openssl_random_pseudo_bytes() 未傳回以密碼編譯方式保護安全的隨機位元組 (bsc#977005)

- CVE-2016-4070：libxml_disable_entity_loader() 設定會在執行緒之間分享，其可導致 XML 外部實體插入和實體擴充問題 (bsc#976997)

- CVE-2015-8866：由於錯誤處理 php_raw_url_encode() 中的大型字串，遠端攻擊者可藉此造成拒絕服務 (bsc#976996)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 在 PHP 之前的 5.5.33 和 5.6.x 之前的 5.6.19 的 PHAR 延伸模組中，zip.c 的 phar_parse_zipfile 函式允許遠端攻擊者從處理程序記憶體取得敏感資訊，或造成拒絕服務 (超出邊界讀取和應用程式損毀)在無效位置放置 PK\x05\x06 簽章。 (CVE-2016-3142)

請注意，Nessus 依賴供應商報告的套件存在。

根據其標題，遠端 Web 伺服器上安裝的 PHP 版本為 5.5.33 之前的 5.5.x 版。因此，會受到多個弱點影響：

- 處理 XML 資料時，檔案 ext/wddx/wddx.c 的 php_wddx_pop_element() 函式中存在一個釋放後使用錯誤。未經驗證的遠端攻擊者可惡意利用此錯誤，透過特製 XML 資料解除參照已釋放的記憶體，進而導致任意程式碼執行。
 (CVE-2016-3141)

- 檔案 ext/phar/zip.c 的 phar_parse_zipfile() 函式中存在一個超出邊界讀取錯誤，其允許未經驗證的遠端攻擊者造成拒絕服務，或是取得敏感資訊的存取權。(CVE-2016-3142)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

在廣為使用的開放來源一般用途指令碼語言 PHP (PHP 的遞迴縮寫：超文字前置處理器) 中，發現數個問題，PHP 語言特別適合用於 web 開發，可以嵌入 HTML 之中。- CVE-2016-2554 ext/phar/tar.c 中存有堆疊型緩衝區溢位，遠端攻擊者可透過特製的 TAR 封存，造成拒絕服務 (應用程式損毀)，或可能有其他不明影響。- CVE-2016-3141 WDDX 延伸模組的 wddx.c 中存有釋放後使用弱點，遠端攻擊者可透過對包含特製 var 元素的 XML 資料觸發 wddx_deserialize 呼叫，造成拒絕服務 (記憶體損毀和應用程式損毀)，或可能有其他不明影響。- CVE-2016-3142 在 PHP 5.5.33 之前版本和 5.6.19 之前的 5.6.x 版本中，PHAR 延伸模組中 zip.c 的 phar_parse_zipfile 函式讓遠端攻擊者可透過將 PK\x05\x06 簽章放置在無效位置，取得處理程序記憶體中的敏感資訊，或是造成拒絕服務 (超出邊界讀取和應用程式損毀)。- CVE-2016-4342 在 PHP 5.5.32 之前版本、5.6.18 之前的 5.6.x 版和 7.0.3 之前的 7.x 版本中，ext/phar/phar_object.c 不當處理零長度未壓縮資料，讓遠端攻擊者可透過特製 (1) TAR、(2) ZIP 或 (3) PHAR 封存，造成拒絕服務 (堆積記憶體損毀) 或可能有其他不明影響。- CVE-2016-9934 在 PHP 5.6.28 之前版本和 7.0.13 之前的 7.x 版本中，ext/wddx/wddx.c 讓遠端攻擊者可透過 wddxPacket XML 文件中的特製序列化資料 (表現方式為 PDORow 字串)，造成拒絕服務 (NULL 指標解除參照)。CVE-2016-9935 - 在 PHP 5.6.29 之前版本和 7.0.14 之前的 7.x 版本中，ext/wddx/wddx.c 的 php_wddx_push_element 函式讓遠端攻擊者可透過 wddxPacket XML 文件中的空布林值元素，造成拒絕服務 (超出邊界讀取和記憶體損毀)，或可能有其他不明影響。- CVE-2016-10158 在 PHP 5.6.30 之前版本、7.0.15 之前的 7.0.x 版和 7.1.1 之前的 7.1.x 版中，ext/exif/exif.c 的 exif_convert_any_to_int 函式讓遠端攻擊者可透過特製的 EXIF 資料，觸發試圖將可表示的最小負整數除以 -1，藉此造成拒絕服務 (應用程式損毀)。- CVE-2016-10159 在 PHP 5.6.30 之前版本和 7.0.15 之前的 7.0.x 版本中，ext/phar/phar.c 的 phar_parse_pharfile 函式存在整數溢位，遠端攻擊者可藉此透過 PHAR 封存中截斷的資訊清單項目，造成拒絕服務 (記憶體消耗或應用程式損毀)。- CVE-2016-10160 在 PHP 5.6.30 之前版本和 7.0.15 之前的 7.0.x 版本中，ext/phar/phar.c 的 phar_parse_pharfile 函式存在差一錯誤，遠端攻擊者可藉此透過別名不符的特製 PHAR 封存，造成拒絕服務 (記憶體損毀) 或可能執行任意程式碼。- CVE-2016-10161 在 PHP 5.6.30 之前版本、7.0.15 之前的 7.0.x 版本和 7.1.1 之前的 7.1.x 版本中，ext/standard/var_unserializer.c 的 object_common1 函式讓遠端攻擊者可透過在 finish_nested_data 呼叫中處理不當的特製序列化資料，藉此造成拒絕服務 (緩衝區過度讀取和應用程式損毀)。- BUG-71323.patch stream_get_meta_data 的輸出會被其輸入篡改 - BUG-70979.patch 錯誤的 SOAP 要求造成損毀 - BUG-71039.patch exec 函式忽略長度，卻會尋找 NULL 終止 - BUG-71459.patch iptcembed() 中存在整數溢位 - BUG-71391.patch phar_tar_setupmetadata() 中存在 NULL 指標解除參照 - BUG-71335.patch WDDX 封包還原序列化中存在類型混淆弱點 針對 Debian 7「Wheezy」，這些問題已在 5.4.45-0+deb7u7 版本中修正。我們建議您升級 php5 套件。注意：Tenable Network Security 已直接從 DLA 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.5 and is affected by multiple vulnerabilities in the following components :

 - AMD
 - apache_mod_php
 - AppleGraphicsControl
 - AppleGraphicsPowerManagement
 - ATS
 - Audio
 - Captive Network Assistant
 - CFNetwork Proxies
 - CommonCrypto
 - CoreCapture
 - CoreStorage
 - Crash Reporter
 - Disk Images
 - Disk Utility
 - Graphics Drivers
 - ImageIO
 - Intel Graphics Driver
 - IOAcceleratorFamily
 - IOAudioFamily
 - IOFireWireFamily
 - IOHIDFamilyKernel
 - libc
 - libxml2
 - libxslt
 - MapKit
 - Messages
 - Multi-Touch
 - NVIDIA Graphics Drivers
 - OpenGL
 - QuickTime
 - SceneKit
 - Screen Lock
 - Tcl

Versions of PHP 5.5.x prior to 5.5.33, or 5.6.x prior to 5.6.19 are vulnerable to the following issues :

 - A use-after-free error exists in the 'php_wddx_pop_element()' function in 'ext/wddx/wddx.c'.  The issue is triggered when handling crafted XML data.  This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'phar_parse_zipfile()' function in 'ext/phar/zip.c' that may allow a remote attacker to trigger a crash or gain unauthorized access to information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97052	Debian DLA-818-1 : php5 security update	Nessus	Debian Local Security Checks	2017/2/8	2021/1/11	critical
130683	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)	Nessus	Huawei Local Security Checks	2019/11/8	2024/4/15	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical
90757	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1145-1)	Nessus	SuSE Local Security Checks	2016/4/27	2021/1/19	critical
90782	openSUSE 安全性更新：php5 (openSUSE-2016-517)	Nessus	SuSE Local Security Checks	2016/4/29	2021/1/19	critical
91228	Mac OS X 10.11.x < 10.11.5 多個弱點	Nessus	MacOS X Local Security Checks	2016/5/19	2024/5/28	high
91665	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
219602	Linux Distros 未修補弱點：CVE-2016-3142	Nessus	Misc.	2025/3/4	2025/8/21	high
90007	PHP 5.5.x < 5.5.33 多個弱點	Nessus	CGI abuses	2016/3/17	2025/5/26	critical
97052	Debian DLA-818-1：php5 安全性更新	Nessus	Debian Local Security Checks	2017/2/8	2021/1/11	critical
131592	EulerOS 2.0 SP2：php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	2019/12/4	2023/4/25	critical
9392	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2016/7/13	2019/3/6	high
9174	PHP 5.5.x < 5.5.33 / 5.6.x < 5.6.19 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/4/8	2019/3/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

high

critical

high

critical

critical

critical

high

critical