2016 年 6 月 23 日、**PHP 5.6.23**

**コア：**

- バグ php#72275（json_encode()/json_decode()/json_utf8_to_utf16() の整数オーバーフロー）を修正しました。
 （Stas）

- バグ php#72400（addcslashes/addslashes の整数オーバーフロー）を修正しました。（Stas）

- バグ php#72403（STRING 型付き ZVAL の長さにおける整数オーバーフロー）を修正しました。（Stas）

**GD：**

- バグ php#72298（pass2_no_dither の領域外アクセス）を修正しました。（Stas）

- バグ php#72337（無効な寸法によるクラッシュの可能性）を修正しました（Pierre 氏）

- バグ php#72339（ヒープオーバーフローを引き起こす _gd2GetHeader() の整数オーバーフロー）を修正しました。（Pierre）

- バグ php#72407（_gdScaleVert での
 NULL ポインターデリファレンス）を修正しました。（Stas）

- バグ php#72446（ヒープオーバーフローを引き起こす gdImagePaletteToTrueColor() の整数オーバーフロー）を修正しました。
 （Pierre）

**Intl：**

- バグ php#70484（selectordinal が指名されたパラメーターで動作しません）を修正しました。（Anatol）

**mbstring：**

- バグ php#72402（_php_mb_regex_ereg_replace_exec - 二重解放）を修正しました。（Stas）

**mcrypt：**

- バグ php#72455（整数オーバーフローによるヒープオーバーフロー）を修正しました。（Stas）

**Phar：**

- バグ php#72321（phar_extract_file() の無効な解放）を修正しました。（hji at dyntopia dot com）

**SPL：**

- バグ php#72262（SplFileObject::fread の int/size_t の取り違え）を修正しました。（Stas）

- バグ php#72433（PHP の GC アルゴリズムでの Use After Free 脆弱性とシリアル化解除）を修正しました。（Dmitry 氏）

**OpenSSL：**

- バグ php#72140（ERR_free_strings() 呼び出し後のセグメンテーション違反）を修正しました。（Jakub Zelenka 氏）

**WDDX：**

- バグ php#72340（wddx_deserialize の二重解放による破損）を修正しました。（Stas）

注意：Tenable Network Security は、前述の説明ブロックを Fedora 更新システム Web サイトから直接抽出しています。
Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

php5 のこの更新により、以下の問題が修正されます。

- 「php -S localhost:8080」で Web サーバーを起動することができます。以前は、特別に細工された HTTP ヘッダーをリクエストに追加することで、CGI スクリプトなどのリクエストハンドラーに対して、任意の $HTTP_PROXY 環境変数を設定することができました（CVE-2016-5385）。そのため、これらのサーバーコンポーネントが悪意のあるプロキシサーバーを通じて、すべての送信 HTTP トラフィックを管理する可能性があります。このパッチでは問題を修正しています：更新された php サーバーは、このような HTTP ヘッダーを無視し、サブプロセスに対して $HTTP_PROXY を一切設定しません。（bnc#988486）

- リモートの攻撃者が、二重解放を誘発する可能性があり、さらに、コールバックを使用する特定の PHP コードを考慮すると、コード実行のベクトルを誘発する可能性があるなど、複数の事例がありました。
 （bnc#986246、bnc#986244、CVE-2016-5768、CVE-2016-5772）

- ユーザーがブラウザとして Internet Explorer を使用している場合、ヘッダーまたはコンテンツ情報（XSS）を注入することができました。（bnc#986004、CVE-2015-8935）

- いくつかの事例で、整数オーバーフローにより過剰なメモリ割り当てが誘発される可能性がありました（bnc#986392、bnc#986388、bnc#986386、bnc#986393、CVE-2016-5770、CVE-2016-5769、CVE-2016-5766、CVE-2016-5767）

- 攻撃者が、ガベージコレクターを悪用して、ターゲットの配列を解放することができました。現時点で、攻撃者が、EIP/RIP を奪取することで、偽の zval オブジェクトを細工し、PHP プロセスを悪用する可能性があります。（bnc#986391、CVE-2016-5771）

この更新は、SUSE:SLE-12 からインポートされました：更新プロジェクトを更新します。

Shotwell was updated to fix the following issues :

  - boo#958382: Shotwell did not perform TLS certificate     verification when publishing photos to external services

The PHP Group reports :

Please reference CVE/URL list for details

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.23. It is, therefore, affected by multiple vulnerabilities :

  - An invalid free flaw exists in the phar_extract_file()     function within file ext/phar/phar_object.c that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2016-4473)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.23, which includes additional bug fixes. Please refer to the upstream changelog for more information :

23 Jun 2016, **PHP 5.6.23**

**Core:**

  - Fixed bug php#72275 (Integer Overflow in     json_encode()/json_decode()/json_utf8_to_utf16()).
    (Stas)

  - Fixed bug php#72400 (Integer Overflow in     addcslashes/addslashes). (Stas)

  - Fixed bug php#72403 (Integer Overflow in Length of     String-typed ZVAL). (Stas)

**GD:**

  - Fixed bug php#72298 (pass2_no_dither out-of-bounds     access). (Stas)

  - Fixed bug php#72337 (invalid dimensions can lead to     crash) (Pierre)

  - Fixed bug php#72339 (Integer Overflow in _gd2GetHeader()     resulting in heap overflow). (Pierre)

  - Fixed bug php#72407 (NULL pointer Dereference at
    _gdScaleVert). (Stas)

  - Fixed bug php#72446 (Integer Overflow in     gdImagePaletteToTrueColor() resulting in heap overflow).
    (Pierre)

**Intl:**

  - Fixed bug php#70484 (selectordinal doesn't work with     named parameters). (Anatol)

**mbstring:**

  - Fixed bug php#72402 (_php_mb_regex_ereg_replace_exec -     double free). (Stas)

**mcrypt:**

  - Fixed bug php#72455 (Heap Overflow due to integer     overflows). (Stas)

**Phar:**

  - Fixed bug php#72321 (invalid free in     phar_extract_file()). (hji at dyntopia dot com)

**SPL:**

  - Fixed bug php#72262 (int/size_t confusion in     SplFileObject::fread). (Stas)

  - Fixed bug php#72433 (Use After Free Vulnerability in     PHP's GC algorithm and unserialize). (Dmitry)

**OpenSSL:**

  - Fixed bug php#72140 (segfault after calling     ERR_free_strings()). (Jakub Zelenka)

**WDDX:**

  - Fixed bug php#72340 (Double Free Courruption in     wddx_deserialize). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2016-4473.patch An invalid free may occur under     certain conditions when processing phar-compatible     archives.

  - CVE-2016-4538.patch The bcpowmod function in     ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 accepts a negative integer     for the scale argument, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a crafted call. (already fixed with     patch for CVE-2016-4537)

  - CVE-2016-5114.patch sapi/fpm/fpm/fpm_log.c in PHP before     5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2     misinterprets the semantics of the snprintf return     value, which allows attackers to obtain sensitive     information from process memory or cause a denial of     service (out-of-bounds read and buffer overflow) via a     long string, as demonstrated by a long URI in a     configuration with custom REQUEST_URI logging.

  - CVE-2016-5399.patch Improper error handling in bzread()

  - CVE-2016-5768.patch Double free vulnerability in the
    _php_mb_regex_ereg_replace_exec function in     php_mbregex.c in the mbstring extension in PHP before     5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows     remote attackers to execute arbitrary code or cause a     denial of service (application crash) by leveraging a     callback exception.

  - CVE-2016-5769.patch Multiple integer overflows in     mcrypt.c in the mcrypt extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via a crafted length value,     related to the (1) mcrypt_generic and (2)     mdecrypt_generic functions.

  - CVE-2016-5770.patch Integer overflow in the     SplFileObject::fread function in spl_directory.c in the     SPL extension in PHP before 5.5.37 and 5.6.x before     5.6.23 allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a     large integer argument, a related issue to     CVE-2016-5096.

  - CVE-2016-5771.patch spl_array.c in the SPL extension in     PHP before 5.5.37 and 5.6.x before 5.6.23 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data.

  - CVE-2016-5772.patch Double free vulnerability in the     php_wddx_process_data function in wddx.c in the WDDX     extension in PHP before 5.5.37, 5.6.x before 5.6.23, and     7.x before 7.0.8 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via crafted XML data that is     mishandled in a wddx_deserialize call.

  - CVE-2016-5773.patch php_zip.c in the zip extension in     PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before     7.0.8 improperly interacts with the unserialize     implementation and garbage collection, which allows     remote attackers to execute arbitrary code or cause a     denial of service (use-after-free and application crash)     via crafted serialized data containing a ZipArchive     object.

  - CVE-2016-6289.patch Integer overflow in the     virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in     PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before     7.0.9 allows remote attackers to cause a denial of     service (stack-based buffer overflow) or possibly have     unspecified other impact via a crafted extract operation     on a ZIP archive.

  - CVE-2016-6290.patch ext/session/session.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly maintain a certain hash data structure,     which allows remote attackers to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via vectors related to session     deserialization.

  - CVE-2016-6291.patch The exif_process_IFD_in_MAKERNOTE     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (out-of-bounds     array access and memory corruption), obtain sensitive     information from process memory, or possibly have     unspecified other impact via a crafted JPEG image.

  - CVE-2016-6292.patch The exif_process_user_comment     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted JPEG     image.

  - CVE-2016-6294.patch The locale_accept_from_http function     in ext/intl/locale/locale_methods.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly restrict calls to the ICU     uloc_acceptLanguageFromHTTP function, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a call with a long argument.

  - CVE-2016-6295.patch ext/snmp/snmp.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9     improperly interacts with the unserialize implementation     and garbage collection, which allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via crafted serialized data, a related issue to     CVE-2016-5773.

  - CVE-2016-6296.patch Integer signedness error in the     simplestring_addn function in simplestring.c in     xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38,     5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote     attackers to cause a denial of service (heap-based     buffer overflow) or possibly have unspecified other     impact via a long first argument to the PHP     xmlrpc_encode_request function.

  - CVE-2016-6297.patch Integer overflow in the     php_stream_zip_opener function in ext/zip/zip_stream.c     in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x     before 7.0.9 allows remote attackers to cause a denial     of service (stack-based buffer overflow) or possibly     have unspecified other impact via a crafted zip:// URL.

  - BUG-70436.patch Use After Free Vulnerability in     unserialize()

  - BUG-72681.patch PHP Session Data Injection     Vulnerability, consume data even if we're not storing     them.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.8. It is, therefore, affected by multiple vulnerabilities :

  - An invalid free flaw exists in the phar_extract_file()     function within file ext/phar/phar_object.c that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2016-4473)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in the nl2br()     function within file ext/standard/string.c when handling     new_length values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.37. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the GD     graphics library in the gdImageFillToBorder() function     within file gd.c when handling crafted images that have     an overly large negative coordinate. An unauthenticated,     remote attacker can exploit this, via a crafted image,     to crash processes linked against the library.
    (CVE-2015-8874)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in the nl2br()     function within file ext/standard/string.c when handling     new_length values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

  - It is possible to launch a web server with 'php -S     localhost:8080' It used to be possible to set an     arbitrary $HTTP_PROXY environment variable for request     handlers -- like CGI scripts -- by including a specially     crafted HTTP header in the request (CVE-2016-5385). As a     result, these server components would potentially direct     all their outgoing HTTP traffic through a malicious     proxy server. This patch fixes the issue: the updated     php server ignores such HTTP headers and never sets     $HTTP_PROXY for sub-processes. (bnc#988486)

  - There was multiple cases where a remote attacker could     trigger a double free and, given specific PHP code using     callbacks, trigger code execution vectors.
    (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)

  - It was possible to inject header or content information     (XSS) when a user was using internet explorer as the     browser. (bnc#986004, CVE-2015-8935)

  - In several cases it was possible for a integer overflow     to trigger an excessive memory allocation (bnc#986392,     bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770,     CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)

  - It was possible for an attacker to abuse the garbage     collector to free a target array. At this point an     attacker could craft a fake zval object and exploit the     PHP process by taking over the EIP/RIP. (bnc#986391,     CVE-2016-5771)

This update was imported from the SUSE:SLE-12:Update update project.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple HSSPI Support
  - AppleEFIRuntime
  - AppleMobileFileIntegrity
  - AppleUCC
  - Application Firewall
  - ATS
  - Audio
  - Bluetooth
  - cd9660
  - CFNetwork
  - CommonCrypto
  - CoreCrypto
  - CoreDisplay
  - curl
  - Date & Time Pref Pane
  - DiskArbitration
  - File Bookmark
  - FontParser
  - IDS - Connectivity
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOThunderboltFamily
  - Kerberos v5 PAM module
  - Kernel
  - libarchive
  - libxml2
  - libxpc
  - libxslt
  - mDNSResponder
  - NSSecureTextField
  - Perl
  - S2 Camera
  - Security
  - Terminal
  - WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A stack consumption vulnerability in GD in PHP allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.
(CVE-2015-8874)

An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image.
(CVE-2016-5766)

An integer overflow, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted image buffer.
(CVE-2016-5767)

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)

The mcrypt_generic() and mdecrypt_generic() functions are prone to integer overflows, resulting in a heap-based overflow. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5769)

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5770)

A use-after-free vulnerability that can occur when calling unserialize() on untrusted input was discovered. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application if the application unserializes untrusted input. (CVE-2016-5771 , CVE-2016-5773)

A double free can occur in wddx_deserialize() when trying to deserialize malicious XML input from user's request. This flaw could possibly cause a PHP application to crash. (CVE-2016-5772)

It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-5385)

(Updated on 2016-08-17: CVE-2016-5385 was fixed in this release but was not previously part of this errata)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
92272	Fedora 22：php（2016-99fbdc5c34）	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	critical
92714	openSUSE セキュリティ更新：php5（openSUSE-2016-921）	Nessus	SuSE Local Security Checks	2016/8/4	2026/1/29	critical
90108	openSUSE Security Update : shotwell (openSUSE-2016-844)	Nessus	SuSE Local Security Checks	2016/3/23	2021/1/19	critical
91839	FreeBSD : php -- multiple vulnerabilities (66d77c58-3b1d-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	2016/6/27	2021/1/4	critical
91898	PHP 5.6.x < 5.6.23 Multiple Vulnerabilities	Nessus	CGI abuses	2016/7/1	2025/5/26	critical
92224	Debian DSA-3618-1 : php5 - security update	Nessus	Debian Local Security Checks	2016/7/15	2026/2/2	critical
92239	Fedora 23 : php (2016-34a6b65583)	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	critical
93568	Debian DLA-628-1 : php5 security update	Nessus	Debian Local Security Checks	2016/9/19	2026/1/23	critical
91899	PHP 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus	CGI abuses	2016/7/1	2026/1/22	critical
92300	Fedora 24 : php (2016-ec372bddb9)	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	critical
91830	Slackware 14.0 / 14.1 / current : php (SSA:2016-176-01)	Nessus	Slackware Local Security Checks	2016/6/27	2021/1/14	critical
91897	PHP 5.5.x < 5.5.37 Multiple Vulnerabilities	Nessus	CGI abuses	2016/7/1	2025/5/26	critical
92272	Fedora 22 : php (2016-99fbdc5c34)	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	critical
92714	openSUSE Security Update : php5 (openSUSE-2016-921) (httpoxy)	Nessus	SuSE Local Security Checks	2016/8/4	2026/1/29	critical
93685	macOS < 10.12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/9/23	2026/1/23	critical
92663	Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)	Nessus	Amazon Linux Local Security Checks	2016/8/2	2026/1/29	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical