Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if this password contains a 0x80 character, which makes it easier for context-dependent attackers to obtain access via an authentication attempt with an initial substring of the intended password, as demonstrated by a Unicode password.

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-762:04 advisory.

    PHP is an HTML-embedded scripting language that allows developers to write dynamically generated web     pages. PHP is ideal for writing database-enabled websites, with built-in integration for several     commercial and non-commercial database management systems. PHP is often used as a replacement for CGI     scripts.
    The php package contains a module that adds support for the PHP language to the Apache HTTP Server.
    Security issues fixed with this release:
     CVE-2010-2950     Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-     dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code     via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to     errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2010-2094.
     CVE-2011-4153     PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote     attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input     to an application that performs strndup operations on untrusted string data, as demonstrated by the define     function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c,     ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and     main/php_open_temporary_file.c.
     CVE-2012-0057     PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary     files via a crafted XSLT stylesheet that uses the libxslt output extension.
     CVE-2012-0781     The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via crafted input to an application that attempts to perform     Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153.
     CVE-2012-0789     Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of     service (memory consumption) by triggering many strtotime function calls, which are not properly handled     by the php_date_parse_tzfile cache.
     CVE-2012-1172     The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open     square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of     service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by     leveraging a script that lacks its own filename restrictions.
     CVE-2012-2336     sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-     cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote     attackers to cause a denial of service (resource consumption) by placing command-line options in the query     string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists     because of an incomplete fix for CVE-2012-1823.
     CVE-2012-2143     The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL,     and other products, does not process the complete cleartext password if this password contains a 0x80     character, which makes it easier for context-dependent attackers to obtain access via an authentication     attempt with an initial substring of the intended password, as demonstrated by a Unicode password.
     CVE-2012-2386     Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14     and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php53 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

It was discovered that the PHP XSL extension did not restrict the file writing capability of libxslt. A remote attacker could use this flaw to create or overwrite an arbitrary file that is writable by the user running PHP, if a PHP script processed untrusted eXtensible Style Sheet Language Transformations (XSLT) content. (CVE-2012-0057)

Note: This update disables file writing by default. A new PHP configuration directive, 'xsl.security_prefs', can be used to enable file writing in XSLT.

A flaw was found in the way PHP validated file names in file upload requests. A remote attacker could possibly use this flaw to bypass the sanitization of the uploaded file names, and cause a PHP script to store the uploaded file in an unexpected directory, by using a directory traversal attack. (CVE-2012-1172)

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way the PHP phar extension processed certain fields of tar archive files. A remote attacker could provide a specially crafted tar archive file that, when processed by a PHP application using the phar extension, could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running PHP. (CVE-2012-2386)

A format string flaw was found in the way the PHP phar extension processed certain PHAR files. A remote attacker could provide a specially crafted PHAR file, which once processed in a PHP application using the phar extension, could lead to information disclosure and possibly arbitrary code execution via a crafted phar:// URI.
(CVE-2010-2950)

A flaw was found in the DES algorithm implementation in the crypt() password hashing function in PHP. If the password string to be hashed contained certain characters, the remainder of the string was ignored when calculating the hash, significantly reducing the password strength. (CVE-2012-2143)

Note: With this update, passwords are no longer truncated when performing DES hashing. Therefore, new hashes of the affected passwords will not match stored hashes generated using vulnerable PHP versions, and will need to be updated.

It was discovered that the fix for CVE-2012-1823, released via RHSA-2012:0547, did not properly filter all php-cgi command line arguments. A specially crafted request to a PHP script could cause the PHP interpreter to execute the script in a loop, or output usage information that triggers an Internal Server Error. (CVE-2012-2336)

A memory leak flaw was found in the PHP strtotime() function call. A remote attacker could possibly use this flaw to cause excessive memory consumption by triggering many strtotime() function calls.
(CVE-2012-0789)

It was found that PHP did not check the zend_strndup() function's return value in certain cases. A remote attacker could possibly use this flaw to crash a PHP application. (CVE-2011-4153)

Upstream acknowledges Rubin Xu and Joseph Bonneau as the original reporters of CVE-2012-2143.

All php53 users should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1608 advisory.

    This advisory aggregates security fixes for the php SRPM in CIQ LTS 8.6. It addresses 13 CVEs:
    CVE-2012-2386, CVE-2013-4248, CVE-2013-4113, CVE-2012-2329, CVE-2019-11043, and 8 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP installed on the remote host is 5.4.x earlier than 5.4.4, and as such is potentially affected the following vulnerabilities :

  - An integer overflow error exists in the function     'phar_parse_tarfile' in the file 'ext/phar/tar.c'. This     error can lead to a heap-based buffer overflow when     handling a maliciously crafted TAR files. Arbitrary code     execution is possible due to this error. (CVE-2012-2386)

  - A weakness exists in the 'crypt' function related to     the DES implementation that can allow brute-force     attacks. (CVE-2012-2143)

  - Several design errors involving the incorrect parsing     of PHP PDO prepared statements could lead to disclosure     of sensitive information or denial of service.
    (CVE-2012-3450)

The PHP development team would like to announce the immediate availability of PHP 5.3.14. All users of PHP are encouraged to upgrade to PHP 5.3.14.

The release fixes multiple security issues: A weakness in the DES implementation of crypt and a heap overflow issue in the phar extension.

PHP 5.3.14 fixes over 30 bugs. Please note that the use of php://fd streams is now restricted to the CLI SAPI

Changelog: http://www.php.net/ChangeLog-5.php#5.3.14

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
69702	Amazon Linux AMI : php (ALAS-2012-95)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	high
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	2012/9/20	2024/5/28	critical
283996	MiracleLinux 4 : php-5.3.3-14.AXS4 (AXSA:2012-762:04)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/2/12	critical
67089	CentOS 5 : php53 (CESA-2012:1047)	Nessus	CentOS Local Security Checks	2013/6/29	2021/1/4	high
364611	Rocky Linux 8.6 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-dbg / etc Multiple Vulnerabilities (ciqsa-2026_1608)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	critical
59530	PHP 5.4.x < 5.4.4 Multiple Vulnerabilities	Nessus	CGI abuses	2012/6/15	2025/5/26	high
59827	Fedora 16 : maniadrive-1.2-32.fc16.6 / php-5.3.14-1.fc16 / php-eaccelerator-0.9.6.1-9.fc16.6 (2012-9762)	Nessus	Fedora Local Security Checks	2012/7/3	2021/1/11	high

检测

插件搜索

high

critical

critical

high

critical

high

high