The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an     application that calls (1) a DOMDocument save method or (2) the GD imagepsloadfont function, as     demonstrated by a filename\0.html attack that bypasses an intended configuration in which client users may     write to only .html files. (CVE-2015-4598)

Note that Nessus relies on the presence of the package as reported by the vendor.

The PHP script interpreter was updated to receive various security fixes :

  - CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class     unserialization type confusion.

  - CVE-2015-4599, CVE-2015-4600, CVE-2015-4601     [bnc#935226]: Fixed type confusion issues in     unserialize() with various SOAP methods.

  - CVE-2015-4603 [bnc#935234]: Fixed     exception::getTraceAsString type confusion issue after     unserialize.

  - CVE-2015-4644 [bnc#935274]: Fixed a crash in     php_pgsql_meta_data.

  - CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in     ftp_genlist() that could result in a heap overflow.

  - CVE-2015-3411, CVE-2015-3412, CVE-2015-4598     [bnc#935227], [bnc#935232]: Added missing null byte     checks for paths in various PHP extensions.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

- CVE-2015-3307 The phar_parse_metadata function in     ext/phar/phar.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to cause a denial of service (heap metadata corruption)     or possibly have unspecified other impact via a crafted     tar archive.

  - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing     null byte checks for paths in various PHP extensions)

  - CVE-2015-4021 The phar_parse_tarfile function in     ext/phar/tar.c in PHP before 5.4.41, 5.5.x before     5.5.25, and 5.6.x before 5.6.9 does not verify that the     first character of a filename is different from the \0     character, which allows remote attackers to cause a     denial of service (integer underflow and memory     corruption) via a crafted entry in a tar archive.

  - CVE-2015-4022 Integer overflow in the ftp_genlist     function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x     before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.

  - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25,     and 5.6.x before 5.6.9 truncates a pathname upon     encountering a \x00 character in certain situations,     which allows remote attackers to bypass intended     extension restrictions and access files or directories     with unexpected names via a crafted argument to (1)     set_include_path, (2) tempnam, (3) rmdir, or (4)     readlink. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2006-7243.

  - CVE-2015-4026 The pcntl_exec implementation in PHP     before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before     5.6.9 truncates a pathname upon encountering a \x00     character, which might allow remote attackers to bypass     intended extension restrictions and execute files with     unexpected names via a crafted first argument. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2006-7243.

  - CVE-2015-4147 The SoapClient::__call method in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that
    __default_headers is an array, which allows remote     attackers to execute arbitrary code by providing crafted     serialized data with an unexpected data type, related to     a 'type confusion' issue.

  - CVE-2015-4148 The do_soap_call function in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that the     uri property is a string, which allows remote attackers     to obtain sensitive information by providing crafted     serialized data with an int data type, related to a     'type confusion' issue.

  - CVE-2015-4598 Incorrect handling of paths with NULs

  - CVE-2015-4599 Type confusion vulnerability in     exception::getTraceAsString

  - CVE-2015-4600 + CVE-2015-4601 Added type checks

  - CVE-2015-4602 Type Confusion Infoleak Vulnerability in     unserialize() with SoapFault

  - CVE-2015-4604 + CVE-2015-4605 denial of service when     processing a crafted file with Fileinfo (already fixed     in CVE-2015-temp-68819.patch)

  - CVE-2015-4643 Improved fix for bug #69545 (Integer     overflow in ftp_genlist() resulting in heap overflow)

  - CVE-2015-4644 Fixed bug #69667 (segfault in     php_pgsql_meta_data)

  - CVE-2015-5589 Segfault in Phar::convertToData on invalid     file

  - CVE-2015-5590 Buffer overflow and stack smashing error     in phar_fix_filepath

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.26. It is, therefore, affected by multiple vulnerabilities :    

  - Multiple heap buffer overflow conditions exist in the     bundled Perl-Compatible Regular Expression (PCRE)     library due to improper validation of user-supplied     input to the compile_branch() and pcre_compile2()     functions. A remote attacker can exploit these     conditions to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2015-2325,     CVE-2015-2326)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of quotes     in collation sequence names. A remote attacker can     exploit this to cause uninitialized memory access,     resulting in denial of service condition.
    (CVE-2015-3414)

  - A denial of service vulnerability exists in the bundled     SQLite component due to an improper implementation of     comparison operators in the sqlite3VdbeExec() function     in vdbe.c. A remote attacker can exploit this to cause     an invalid free operation, resulting in a denial of     service condition. (CVE-2015-3415)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of precision     and width values during floating-point conversions in     the sqlite3VXPrintf() function in printf.c. A remote     attacker can exploit this to cause a stack-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-3416)

  - A security bypass vulnerability exists due to a failure     in multiple extensions to check for NULL bytes in a path     when processing or reading a file. A remote attacker can     exploit this, by combining the '\0' character with a     safe file extension, to bypass access restrictions.
    (CVE-2015-4598)

  - An arbitrary command injection vulnerability exists due     to a flaw in the php_escape_shell_arg() function in     exec.c. A remote attacker can exploit this, via the     escapeshellarg() PHP method, to inject arbitrary     operating system commands. (CVE-2015-4642)

  - A heap buffer overflow condition exists in the     ftp_genlist() function in ftp.c. due to improper     validation of user-supplied input. A remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2015-4643)     
  - A denial of service vulnerability exists due to a NULL     pointer dereference flaw in the build_tablename()     function in pgsql.c. An authenticated, remote attacker     can exploit this to cause an application crash.
    (CVE-2015-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory.

    - fix patch for CVE-2015-4024
    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
    - core: fix use-after-free in unserialize CVE-2015-2787
    - exif: fix free on unitialized pointer CVE-2015-0232
    - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
    - date: fix use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - phar: use after free in phar_object.c CVE-2015-2301

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
218935	Linux Distros Unpatched Vulnerability : CVE-2015-4598	Nessus	Misc.	2025/3/4	2026/1/28	medium
84557	openSUSE Security Update : php5 (openSUSE-2015-471)	Nessus	SuSE Local Security Checks	2015/7/7	2021/1/19	critical
84648	CentOS 6 : php (CESA-2015:1218)	Nessus	CentOS Local Security Checks	2015/7/13	2021/1/4	critical
85808	Debian DLA-307-1 : php5 security update	Nessus	Debian Local Security Checks	2015/9/8	2021/1/11	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	2015/6/24	2021/1/4	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	2015/6/24	2021/2/5	critical
84363	PHP 5.5.x < 5.5.26 Multiple Vulnerabilities	Nessus	CGI abuses	2015/6/24	2025/5/26	critical
84659	Oracle Linux 6 : php (ELSA-2015-1218)	Nessus	Oracle Linux Local Security Checks	2015/7/13	2024/10/22	critical

检测

插件搜索

medium

critical

critical

critical

critical

critical

critical

critical