This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403]

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

Bugfixes :

  - Compare with SQL_NULL_DATA correctly [bnc#935074]

  - If MD5 was disabled in net-snmp we have to disable the     used MD5 function in ext/snmp/snmp.c as well.
    (bsc#944302)

Also the Suhosin framework was updated to 0.9.38. [fate#319325]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2014-8142)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4026)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6834)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4025)

  - An integer overflow flaw was found in the way custom     objects were unserialized. Specially crafted input     processed by the unserialize() function could cause a     PHP application to crash.(CVE-2014-3669)

  - It was found that PHP move_uploaded_file() function did     not properly handle file names with a NULL character. A     remote attacker could possibly use this flaw to make a     PHP script access unexpected files and bypass intended     file system access restrictions.(CVE-2015-2348)

  - An integer overflow flaw leading to a heap-based buffer     overflow was found in the way PHP's FTP extension     parsed file listing FTP server responses. A malicious     FTP server could use this flaw to cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4022)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6836)

  - A NULL pointer dereference flaw was found in the     XSLTProcessor class in PHP. An attacker could use this     flaw to cause a PHP application to crash if it     performed Extensible Stylesheet Language (XSL)     transformations using untrusted XSLT files and allowed     the use of PHP functions to be used as XSLT functions     within XSL stylesheets.(CVE-2015-6837)

  - It was found that PHP's gd extension did not properly     handle file names with a null character. A remote     attacker could possibly use this flaw to make a PHP     application access unexpected files and bypass intended     file system access restrictions.(CVE-2014-5120)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6835)

  - Stack consumption vulnerability in     Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to cause a denial of service (segmentation     fault) via recursive method calls.(CVE-2015-8873)

  - An uninitialized pointer use flaw was found in PHP's     Exif extension. A specially crafted JPEG or TIFF file     could cause a PHP application using the     exif_read_data() function to crash or, possibly,     execute arbitrary code with the privileges of the user     running that PHP application.(CVE-2015-0232)

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-2787)

  - A buffer over-read flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2783)

  - A use-after-free flaw was found in the unserialize()     function of PHP's DateTimeZone implementation. A     malicious script author could possibly use this flaw to     disclose certain portions of server     memory.(CVE-2015-0273)

  - Multiple buffer over-read flaws were found in the     php_parserr() function of PHP. A malicious DNS server     or a man-in-the-middle attacker could possibly use this     flaw to crash a PHP application that used the     dns_get_record() function to perform a DNS     query.(CVE-2014-3597)

  - A buffer overflow flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3329)

  - Integer overflow in the ftp_genlist function in     ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before     5.5.26, and 5.6.x before 5.6.10 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-4022.(CVE-2015-4643)

  - A type confusion issue was found in PHP's phpinfo()     function. A malicious script author could possibly use     this flaw to disclose certain portions of server     memory.(CVE-2014-4721)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-140:02 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated web pages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    This package contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP 2.4 Server.
    Security issues fixed with this release:
    CVE-2015-5589
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5590     Stack-based buffer overflow in the phar_fix_filepath function in     ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x     before 5.6.11 allows remote attackers to cause a denial of service or     possibly have unspecified other impact via a large length value, as     demonstrated by mishandling of an e-mail attachment by the imap PHP     extension.
    CVE-2015-6831     Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44,     5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to     execute arbitrary code via vectors involving (1) ArrayObject, (2)     SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled     during unserialization.
    CVE-2015-6832     Use-after-free vulnerability in the SPL unserialize implementation in     ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and     5.6.x before 5.6.12 allows remote attackers to execute arbitrary code     via crafted serialized data that triggers misuse of an array field.
    CVE-2015-6833     Directory traversal vulnerability in the PharData class in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to write to arbitrary files via a .. (dot dot) in a ZIP     archive entry that is mishandled during an extractTo call.
    CVE-2015-6834
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6835
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6836     The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45,     5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage     headers, which allows remote attackers to execute arbitrary code via     crafted serialized data that triggers a type confusion in the     serialize_function_call function.
    CVE-2015-6837
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6838
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7803     The phar_get_entry_data function in ext/phar/util.c in PHP before     5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via     a .phar file with a crafted TAR archive entry in which the Link     indicator references a file that does not exist.
    CVE-2015-7804     Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c     in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers     to cause a denial of service (uninitialized pointer dereference and     application crash) by including the / filename in a .zip PHAR archive.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to new upstream versions (5.4.45 and 5.6.13), which include additional bug fixes.
Please refer to the upstream changelog for more information :

  - https://php.net/ChangeLog-5.php#5.4.45
  - https://php.net/ChangeLog-5.php#5.6.13

- CVE-2015-6831 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6832 Dangling pointer in the unserialization of     ArrayObject items.

  - CVE-2015-6833 Files extracted from archive may be placed     outside of destination directory

  - CVE-2015-6834 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6836 A type confusion occurs within SOAP     serialize_function_call due to an insufficient     validation of the headers field. In the SoapClient's
    __call method, the verify_soap_headers_array check is     applied only to headers retrieved from     zend_parse_parameters; problem is that a few lines     later, soap_headers could be updated or even replaced     with values from the __default_headers object fields.

  - CVE-2015-6837 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-6838 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-7803 A NULL pointer dereference flaw was found     in the way PHP's Phar extension parsed Phar archives. A     specially crafted archive could cause PHP to crash.

  - CVE-2015-7804 An uninitialized pointer use flaw was     found in the phar_make_dirstream() function of PHP's     Phar extension. A specially crafted phar file in the ZIP     format with a directory entry with a file name '/ZIP'     could cause a PHP application function to crash.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x     before 5.6.13 does not properly manage headers, which allows remote attackers to execute arbitrary code     via crafted serialized data that triggers a type confusion in the serialize_function_call function.
    (CVE-2015-6836)

Note that Nessus relies on the presence of the package as reported by the vendor.

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb)

  - Fixed bug #70277 (new DateTimeZone($foo) is ignoring     text after null byte). (cmb) **EXIF:** * Fixed bug     #70385 (Buffer over-read in exif_read_data with TIFF IFD     tag byte value of 32 bytes). (Stas) **hash:** * Fixed     bug #70312 (HAVAL gives wrong hashes in specific cases).
    (letsgolee at naver dot com) **MCrypt:** * Fixed bug     #69833 (mcrypt fd caching not working). (Anatol)
    **Opcache:** * Fixed bug #70237 (Empty while and     do-while segmentation fault with opcode on CLI enabled).
    (Dmitry, Laruence) **PCRE:** * Fixed bug #70232     (Incorrect bump-along behavior with \K and empty string     match). (cmb) * Fixed bug #70345 (Multiple     vulnerabilities related to PCRE functions). (Anatol     Belski) **SOAP:** * Fixed bug #70388 (SOAP     serialize_function_call() type confusion / RCE). (Stas)
    **SPL:** * Fixed bug #70290 (NULL pointer deref     (segfault) in spl_autoload via ob_start). (hugh at     allthethings dot co dot nz) * Fixed bug #70303     (Incorrect constructor reflection for ArrayObject).
    (cmb) * Fixed bug #70365 (Use-after-free vulnerability     in unserialize() with SplObjectStorage). (taoguangchen     at icloud dot com) * Fixed bug #70366 (Use-after-free     vulnerability in unserialize() with     SplDoublyLinkedList). (taoguangchen at icloud dot com)
    **Standard:** * Fixed bug #70052 (getimagesize() fails     for very large and very small WBMP). (cmb) * Fixed bug     #70157 (parse_ini_string() segmentation fault with     INI_SCANNER_TYPED). (Tjerk) **XSLT:** * Fixed bug #69782     (NULL pointer dereference). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Use after free vulnerability was found in unserialize() function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.28. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist in spl_array.c,     spl_observer.c, and spl_dllist.c due to improper     sanitization of input to the unserialize() function. An     attacker can exploit these issues, by using a specially     crafted SplDoublyLinkedList, SplArrayObject, or     SplObjectStorage object, to deference freed memory and     thus execute arbitrary code. (CVE-2015-6831)

  - A dangling pointer error exists in file spl_array.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplDoublyLinkedList object, to gain     control over a deallocated pointer and thus execute     arbitrary code. (CVE-2015-6832)

  - A path traversal flaw exists in file phar_object.c due     to improper sanitization of user-supplied input. An     attacker can exploit this to write arbitrary files.
    (CVE-2015-6833)

  - A type confusion flaw exists in the     serialize_function_call() function in soap.c due to     improper validation of input passed via the header     field. A remote attacker can exploit this to execute     arbitrary code. (CVE-2015-6836)

  - Multiple type confusion flaws exist in the _call()     method in file php_http.c when handling calls for     zend_hash_get_current_key or 'Z*'. An attacker can     exploit this to disclose memory contents or crash     an application using PHP. (CVE-2015-8835)

  - The openssl_random_pseudo_bytes() function in file     openssl.c does not generate sufficiently random numbers.
    This allows an attacker to more easily predict the     results, thus allowing further attacks to be carried     out. (CVE-2015-8867)

  - A flaw exists in file zend_exceptions.c due to the     improper use of the function unserialize() during     recursive method calls. A remote attacker can exploit     this to crash an application using PHP. (CVE-2015-8873)

  - A flaw exists in file zend_exceptions.c due to     insufficient type checking by functions unserialize()     and __toString(). A remote attacker can exploit this to     cause a NULL pointer deference or unexpected method     execution, thus causing an application using PHP to     crash. (CVE-2015-8876)

  - An integer truncation flaw exists in the     zend_hash_compare() function in zend_hash.c that is     triggered when comparing arrays. A remote attacker can     exploit this to cause arrays to be improperly matched     during comparison.
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

It also includes a bugfix for the odbc module :

  - compare with SQL_NULL_DATA correctly [bnc#935074]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.45. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 )

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

As reported upstream, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name '/ZIP' could cause a PHP application function to crash. (CVE-2015-7804)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119971	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1633-1)	Nessus	SuSE Local Security Checks	2019/1/2	2022/5/24	critical
124996	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
289070	MiracleLinux 7 : rh-php56-php-5.6.5-8.el7 (AXSA:2016-140:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
85914	Debian DSA-3358-1 : php5 - security update	Nessus	Debian Local Security Checks	2015/9/14	2021/1/11	critical
86794	Debian DLA-341-1 : php5 security update	Nessus	Debian Local Security Checks	2015/11/9	2021/1/11	critical
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/6/20	2021/1/11	critical
219077	Linux Distros Unpatched Vulnerability : CVE-2015-6836	Nessus	Misc.	2025/3/4	2025/8/19	high
86030	Fedora 23 : php-5.6.13-1.fc23 (2015-14978)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	critical
91433	F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)	Nessus	F5 Networks Local Security Checks	2016/6/2	2019/4/11	critical
85299	PHP 5.5.x < 5.5.28 Multiple Vulnerabilities	Nessus	CGI abuses	2015/8/11	2025/5/26	critical
86616	SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)	Nessus	SuSE Local Security Checks	2015/10/27	2021/1/19	high
85885	PHP 5.4.x < 5.4.45 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2025/5/26	high
86495	Amazon Linux AMI : php56 (ALAS-2015-601)	Nessus	Amazon Linux Local Security Checks	2015/10/22	2018/4/18	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

high

high

critical