The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This security update of PHP fixes the following issues :

Security issues fixed :

  - CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data     remote DOS Vulnerability.

  - CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check     path validity.

  - CVE-2015-4022 [bnc#931772]: Fixed and overflow in     ftp_genlist() that resulted in a heap overflow.

  - CVE-2015-4021 [bnc#931769]: Fixed memory corruption in     phar_parse_tarfile when entry filename starts with NULL.

  - CVE-2015-4148 [bnc#933227]: Fixed SoapClient's     do_soap_call() type confusion after unserialize()     information disclosure.

  - CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class     unserialization type confusion.

  - CVE-2015-4599, CVE-2015-4600, CVE-2015-4601     [bnc#935226]: Fixed type confusion issues in     unserialize() with various SOAP methods.

  - CVE-2015-4603 [bnc#935234]: Fixed     exception::getTraceAsString type confusion issue after     unserialize.

  - CVE-2015-4644 [bnc#935274]: Fixed a crash in     php_pgsql_meta_data.

  - CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in     ftp_genlist() that could result in a heap overflow.

  - CVE-2015-3411, CVE-2015-3412, CVE-2015-4598     [bnc#935227], [bnc#935232]: Added missing null byte     checks for paths in various PHP extensions.

Bugs fixed :

  - configure php-fpm with --localstatedir=/var [bnc#927147]

  - fix timezone map [bnc#919080]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory.

    Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote     attacker could possibly use this issue to bypass intended restrictions and create or obtain access to     sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598)

    Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL     byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service.
    (CVE-2015-4021)

    Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP     servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022,     CVE-2015-4643)

    Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could     use this issue with crafted form data to cause CPU consumption, leading to a denial of service.
    (CVE-2015-4024)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a     string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive     information. (CVE-2015-4148)

    Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote     attacker could possibly use these issues to obtain sensitive information or cause a denial of service.
    (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

    It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected     Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605)

    It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.7. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists related to function     'unserialize', which can allow a remote attacker to     execute arbitrary code. Note that this issue is due to     an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

  - An integer overflow error exists in function 'regcomp'     in the Henry Spencer regex library, due to improper     validation of user-supplied input. An attacker can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2305)

  - An integer overflow error exists in the '_zip_cdir_new'     function, due to improper validation of user-supplied     input. An attacker, using a crafted ZIP archive, can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2331)

  - A filter bypass vulnerability exists due to a flaw in     the move_uploaded_file() function in which pathnames are     truncated when a NULL byte is encountered. This allows a     remote attacker, via a crafted second argument, to     bypass intended extension restrictions and create files     with unexpected names. (CVE-2015-2348)

  - A user-after-free error exists in the     process_nested_data() function. This allows a remote     attacker, via a crafted unserialize call, to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-2787)

  - A type confusion vulnerability in the     SoapClient's __call() function in ext/soap/soap.c     could allow a remote attacker to execute arbitrary     code by providing crafted serialized data with an     unexpected data type (CVE-2015-4147, CVE-2015-4148)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7.9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0728 advisory.

    This advisory aggregates security fixes for the php SRPM in CIQ CentOS Bridge 7.9. It addresses 65 CVEs:
    CVE-2023-0568, CVE-2021-21702, CVE-2015-6838, CVE-2019-19204, CVE-2016-6297, and 60 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
119968	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1253-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	2015/6/24	2024/10/22	critical
84563	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)	Nessus	Ubuntu Local Security Checks	2015/7/7	2025/9/3	critical
84660	RHEL 6 : php (RHSA-2015:1218)	Nessus	Red Hat Local Security Checks	2015/7/13	2021/2/5	critical
84661	Scientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)	Nessus	Scientific Linux Local Security Checks	2015/7/13	2021/1/14	critical
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
82027	PHP 5.6.x < 5.6.7 Multiple Vulnerabilities	Nessus	CGI abuses	2015/3/24	2025/5/26	critical
355689	CentOS Linux 7.9 [CIQ] Security Update: php / php-bcmath / php-cli / php-common / php-dba / php-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0728)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/8	critical

检测

插件搜索

high

critical

critical

critical

critical

critical

high

critical

critical