Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

  - CVE-2016-2554 Stack-based buffer overflow in     ext/phar/tar.c allows remote attackers to cause a denial     of service (application crash) or possibly have     unspecified other impact via a crafted TAR archive.

  - CVE-2016-3141 Use-after-free vulnerability in wddx.c in     the WDDX extension allows remote attackers to cause a     denial of service (memory corruption and application     crash) or possibly have unspecified other impact by     triggering a wddx_deserialize call on XML data     containing a crafted var element.

  - CVE-2016-3142 The phar_parse_zipfile function in zip.c     in the PHAR extension in PHP before 5.5.33 and 5.6.x     before 5.6.19 allows remote attackers to obtain     sensitive information from process memory or cause a     denial of service (out-of-bounds read and application     crash) by placing a PK\x05\x06 signature at an invalid     location.

  - CVE-2016-4342 ext/phar/phar_object.c in PHP before     5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3     mishandles zero-length uncompressed data, which allows     remote attackers to cause a denial of service (heap     memory corruption) or possibly have unspecified other     impact via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.

  - CVE-2016-9934 ext/wddx/wddx.c in PHP before 5.6.28 and     7.x before 7.0.13 allows remote attackers to cause a     denial of service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.

  - CVE-2016-9935 The php_wddx_push_element function in     ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before     7.0.14 allows remote attackers to cause a denial of     service (out-of-bounds read and memory corruption) or     possibly have unspecified other impact via an empty     boolean element in a wddxPacket XML document.

  - CVE-2016-10158 The exif_convert_any_to_int function in     ext/exif/exif.c in PHP before 5.6.30, 7.0.x before     7.0.15, and 7.1.x before 7.1.1 allows remote attackers     to cause a denial of service (application crash) via     crafted EXIF data that triggers an attempt to divide the     minimum representable negative integer by -1.

  - CVE-2016-10159 Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     consumption or application crash) via a truncated     manifest entry in a PHAR archive.

  - CVE-2016-10160 Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     before 5.6.30 and 7.0.x before 7.0.15 allows remote     attackers to cause a denial of service (memory     corruption) or possibly execute arbitrary code via a     crafted PHAR archive with an alias mismatch.

  - CVE-2016-10161 The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data call.

  - BUG-71323.patch Output of stream_get_meta_data can be     falsified by its input

  - BUG-70979.patch Crash on bad SOAP request

  - BUG-71039.patch exec functions ignore length but look     for NULL termination

  - BUG-71459.patch Integer overflow in iptcembed()

  - BUG-71391.patch NULL pointer Dereference in     phar_tar_setupmetadata()

  - BUG-71335.patch Type confusion vulnerability in WDDX     packet deserialization

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u7.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0728 advisory.

    This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 65 CVEs:
    CVE-2023-0568, CVE-2021-21702, CVE-2015-6838, CVE-2019-19204, CVE-2016-6297, and 60 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Zend/zend_exceptions.c in PHP, possibly 5.x before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (infinite loop) via a     crafted Exception object in serialized data, a related     issue to CVE-2015-8876.(CVE-2016-7478)

  - ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before     7.0.11 proceeds with SplArray unserialization without     validating a return value and data type, which allows     remote attackers to cause a denial of service or     possibly have unspecified other impact via crafted     serialized data.(CVE-2016-7417)

  - ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x     before 5.6.18, and 7.x before 7.0.3 mishandles     zero-length uncompressed data, which allows remote     attackers to cause a denial of service (heap memory     corruption) or possibly have unspecified other impact     via a crafted (1) TAR, (2) ZIP, or (3) PHAR     archive.(CVE-2016-4342)

  - The php_wddx_process_data function in ext/wddx/wddx.c     in PHP before 5.6.25 and 7.x before 7.0.10 allows     remote attackers to cause a denial of service     (segmentation fault) or possibly have unspecified other     impact via an invalid ISO 8601 time value, as     demonstrated by a wddx_deserialize call that mishandles     a dateTime element in a wddxPacket XML     documenti1/4Z(CVE-2016-7129)

  - Integer signedness error in the simplestring_addn     function in simplestring.c in xmlrpc-epi through     0.54.2, as used in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9, allows remote attackers     to cause a denial of service (heap-based buffer     overflow) or possibly have unspecified other impact via     a long first argument to the PHP xmlrpc_encode_request     function.(CVE-2016-6296)

  - ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 improperly interacts with     the unserialize implementation and garbage collection,     which allows remote attackers to cause a denial of     service (use-after-free and application crash) or     possibly have unspecified other impact via crafted     serialized data, a related issue to     CVE-2016-5773.(CVE-2016-6295)

  - ext/session/session.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 does not properly     maintain a certain hash data structure, which allows     remote attackers to cause a denial of service     (use-after-free) or possibly have unspecified other     impact via vectors related to session     deserialization.(CVE-2016-6290)

  - Integer overflow in the php_stream_zip_opener function     in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted zip:// URL.(CVE-2016-6297)

  - The phar_make_dirstream function in     ext/phar/dirstream.c in PHP before 5.6.18 and 7.x     before 7.0.3 mishandles zero-size ././@LongLink files,     which allows remote attackers to cause a denial of     service (uninitialized pointer dereference) or possibly     have unspecified other impact via a crafted TAR     archive.(CVE-2016-4343)

  - ext/intl/msgformat/msgformat_format.c in PHP before     5.6.26 and 7.x before 7.0.11 does not properly restrict     the locale length provided to the Locale class in the     ICU library, which allows remote attackers to cause a     denial of service (application crash) or possibly have     unspecified other impact via a     MessageFormatter::formatMessage call with a long first     argument.(CVE-2016-7416)

  - ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before     7.0.10 allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or possibly have unspecified other impact via a     malformed wddxPacket XML document that is mishandled in     a wddx_deserialize call, as demonstrated by a tag that     lacks a i1/4oe (less than) character.(CVE-2016-7131)

  - ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before     7.0.10 allows remote attackers to cause a denial of     service (NULL pointer dereference and application     crash) or possibly have unspecified other impact via an     invalid wddxPacket XML document that is mishandled in a     wddx_deserialize call, as demonstrated by a stray     element inside a boolean element, leading to incorrect     pop processing.(CVE-2016-7132)

  - The php_wddx_pop_element function in ext/wddx/wddx.c in     PHP before 5.6.25 and 7.x before 7.0.10 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) or possibly have     unspecified other impact via an invalid base64 binary     value, as demonstrated by a wddx_deserialize call that     mishandles a binary element in a wddxPacket XML     documenti1/4Z( CVE-2016-7130)

  - The imagegammacorrect function in ext/gd/gd.c in PHP     before 5.6.25 and 7.x before 7.0.10 does not properly     validate gamma values, which allows remote attackers to     cause a denial of service (out-of-bounds write) or     possibly have unspecified other impact by providing     different signs for the second and third     arguments.(CVE-2016-7127)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2984-1 advisory.

    It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

    Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip     archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078)

    It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

    It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2016-4070)

    It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

    It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

    It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

    It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.
    (CVE-2016-4342, CVE-2016-4343)

    It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    (CVE-2016-4537, CVE-2016-4538)

    It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4539)

    It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
    (CVE-2016-4540, CVE-2016-4541)

    It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542,     CVE-2016-4543, CVE-2016-4544)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

Security issues fixed :

  - CVE-2016-4346: heap overflow in ext/standard/string.c     (bsc#977994)

  - CVE-2016-4342: heap corruption in tar/zip/phar parser     (bsc#977991)

  - CVE-2016-4537, CVE-2016-4538: bcpowmod accepts negative     scale causing heap buffer overflow corrupting _one_     definition (bsc#978827)

  - CVE-2016-4539: Malformed input causes segmentation fault     in xml_parse_into_struct() function (bsc#978828)

  - CVE-2016-4540, CVE-2016-4541: Out-of-bounds memory read     in zif_grapheme_stripos when given negative offset     (bsc#978829)

  - CVE-2016-4542, CVE-2016-4543, CVE-2016-4544:
    Out-of-bounds heap memory read in exif_read_data()     caused by malformed input (bsc#978830)

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function (bsc#980366)

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c (bsc#980373)

  - CVE-2015-8874: Stack consumption vulnerability in GD     (bsc#980375)

This update was imported from the SUSE:SLE-12:Update update project.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.18. It is, therefore, affected by multiple vulnerabilities :

  - The Perl-Compatible Regular Expressions (PCRE) library     is affected by multiple vulnerabilities related to the     handling of regular expressions, subroutine calls, and     binary files. A remote attacker can exploit these to     cause a denial of service, obtain sensitive information,     or have other unspecified impact. (CVE-2015-8383,     CVE-2015-8386, CVE-2015-8387, CVE-2015-8389,     CVE-2015-8390, CVE-2015-8391, CVE-2015-8393,     CVE-2015-8394)

  - A flaw exists in file ext/standard/exec.c in the     escapeshellcmd() and escapeshellarg() functions due to     the program truncating NULL bytes in strings. A remote     attacker can exploit this to bypass restrictions.

  - A flaw exists in file ext/standard/streamsfuncs.c in the     stream_get_meta_data() function due to a failure to     restrict writing user-supplied data to fields not     already set. A remote attacker can exploit this to     falsify the output of the function, resulting in the     insertion of malicious metadata.

  - A type confusion error exists in file ext/wddx/wddx.c in     the php_wddx_pop_element() function when deserializing     WDDX packets. A remote attacker can exploit this to have     an unspecified impact.

  - A flaw exists in file ext/phar/phar_object.c in the     PharFileInfo::getContent() method due to the use of     uninitialized memory causing improper validation of     user-supplied input. A remote attacker can exploit this     to corrupt memory, resulting in a denial of service or     the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in file     ext/phar/tar.c in the phar_tar_setupmetadata() function     when parsing metadata from a crafted TAR file. A remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in file     ext/standard/iptc.c in the iptcembed() function due to     improper validation of user-supplied input. A remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service or the     execution of arbitrary code.

  - An overflow condition exists in file ext/phar/tar.c in     the phar_parse_tarfile() function due to improper     validation of user-supplied input when decompressing     TAR files. A remote attacker can exploit this to cause     a stack-based buffer overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-2554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
97052	Debian DLA-818-1 : php5 security update	Nessus	Debian Local Security Checks	2017/2/8	2026/1/1	critical
355689	CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0728)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/8	critical
99915	EulerOS 2.0 SP2 : php (EulerOS-SA-2017-1068)	Nessus	Huawei Local Security Checks	2017/5/2	2025/12/22	critical
91320	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-2984-1)	Nessus	Ubuntu Local Security Checks	2016/5/25	2025/9/3	critical
91531	openSUSE Security Update : php5 (openSUSE-2016-696)	Nessus	SuSE Local Security Checks	2016/6/9	2021/1/19	critical
88694	PHP 5.6.x < 5.6.18 Multiple Vulnerabilities	Nessus	CGI abuses	2016/2/11	2025/5/26	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical