The PHP5 script interpreter was updated to fix security issues :

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 )

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

As reported upstream, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name '/ZIP' could cause a PHP application function to crash. (CVE-2015-7804)

The remote host is running a version of Mac OS X that is 10.9.5 or later but prior to 10.11.1 It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework (CVE-2015-5940)

  - apache_mod_php (CVE-2015-0235, CVE-2015-0273,     CVE-2015-6834, CVE-2015-6835, CVE-2015-6836,     CVE-2015-6837, CVE-2015-6838)

  - ATS (CVE-2015-6985)

  - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)

  - Bom (CVE-2015-7006)

  - CFNetwork (CVE-2015-7023)

  - configd (CVE-2015-7015)

  - CoreGraphics (CVE-2015-5925, CVE-2015-5926)

  - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992,     CVE-2015-7017)

  - Directory Utility (CVE-2015-6980)

  - Disk Images (CVE-2015-6995)

  - EFI (CVE-2015-7035)

  - File Bookmark (CVE-2015-6987)

  - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976,     CVE-2015-6977, CVE-2015-6978, CVE-2015-6990,     CVE-2015-6991, CVE-2015-6993, CVE-2015-7008,     CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)

  - Grand Central Dispatch (CVE-2015-6989)

  - Graphics Drivers (CVE-2015-7019, CVE-2015-7020,     CVE-2015-7021)

  - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937,     CVE-2015-5938, CVE-2015-5939)

  - IOAcceleratorFamily (CVE-2015-6996)

  - IOHIDFamily (CVE-2015-6974)

  - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)

  - libarchive (CVE-2015-6984)

  - MCX Application Restrictions (CVE-2015-7016)

  - Net-SNMP (CVE-2014-3565, CVE-2012-6151)

  - OpenGL (CVE-2015-5924)

  - OpenSSH (CVE-2015-6563)

  - Sandbox (CVE-2015-5945)

  - Script Editor (CVE-2015-7007)

  - Security (CVE-2015-6983, CVE-2015-7024)

  - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

PHP reports :

- Core :

- Fixed bug #70172 (Use After Free Vulnerability in unserialize()).

- Fixed bug #70219 (Use after free vulnerability in session deserializer).

- EXIF :

- Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).

- hash :

- Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).

- PCRE :

- Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).

- SOAP :

- Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).

- SPL :

- Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).

- Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).

- XSLT :

- Fixed bug #69782 (NULL pointer dereference).

- ZIP :

- Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.29. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.13. It is, therefore, affected by multiple vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function, which a remote attacker can     exploit to execute arbitrary code. (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field, which a remote attacker     can exploit to have unspecified impact. (CVE-2015-6836)

  - A flaw exists in the XSLTProcessor class due to     improper validation of input from the libxslt library,     which a remote attacker can exploit to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

  - A NULL pointer dereference flaw exists in the     spl_autoload() function in file php_spl.c due to     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a PHP application to crash.

  - A flaw exists in the parse_ini_file() and     parse_ini_string() functions due to improper     sanitization of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a PHP     application to crash.

  - A flaw exists in the CLI SAPI Web Server due to improper     sanitization of user-supplied input. An unauthenticated,     remote attacker can exploit this to access arbitrary     files outside of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb)

  - Fixed bug #70277 (new DateTimeZone($foo) is ignoring     text after null byte). (cmb) **EXIF:** * Fixed bug     #70385 (Buffer over-read in exif_read_data with TIFF IFD     tag byte value of 32 bytes). (Stas) **hash:** * Fixed     bug #70312 (HAVAL gives wrong hashes in specific cases).
    (letsgolee at naver dot com) **MCrypt:** * Fixed bug     #69833 (mcrypt fd caching not working). (Anatol)
    **Opcache:** * Fixed bug #70237 (Empty while and     do-while segmentation fault with opcode on CLI enabled).
    (Dmitry, Laruence) **PCRE:** * Fixed bug #70232     (Incorrect bump-along behavior with \K and empty string     match). (cmb) * Fixed bug #70345 (Multiple     vulnerabilities related to PCRE functions). (Anatol     Belski) **SOAP:** * Fixed bug #70388 (SOAP     serialize_function_call() type confusion / RCE). (Stas)
    **SPL:** * Fixed bug #70290 (NULL pointer deref     (segfault) in spl_autoload via ob_start). (hugh at     allthethings dot co dot nz) * Fixed bug #70303     (Incorrect constructor reflection for ArrayObject).
    (cmb) * Fixed bug #70365 (Use-after-free vulnerability     in unserialize() with SplObjectStorage). (taoguangchen     at icloud dot com) * Fixed bug #70366 (Use-after-free     vulnerability in unserialize() with     SplDoublyLinkedList). (taoguangchen at icloud dot com)
    **Standard:** * Fixed bug #70052 (getimagesize() fails     for very large and very small WBMP). (cmb) * Fixed bug     #70157 (parse_ini_string() segmentation fault with     INI_SCANNER_TYPED). (Tjerk) **XSLT:** * Fixed bug #69782     (NULL pointer dereference). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29,     and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not consider the possibility of a NULL     valuePop return value before proceeding with a free operation during initial error checking, which allows     remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a     crafted XML document, a different vulnerability than CVE-2015-6838. (CVE-2015-6837)

Note that Nessus relies on the presence of the package as reported by the vendor.

Use after free vulnerability was found in unserialize() function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.45. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

It also includes a bugfix for the odbc module :

  - compare with SQL_NULL_DATA correctly [bnc#935074]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86340	SUSE SLES11 Security Update : php5 (SUSE-SU-2015:1701-1)	Nessus	SuSE Local Security Checks	2015/10/12	2021/1/19	high
86496	Amazon Linux AMI : php55 (ALAS-2015-602)	Nessus	Amazon Linux Local Security Checks	2015/10/22	2018/4/18	critical
86654	Mac OS X < 10.11.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/10/29	2024/5/28	critical
85859	FreeBSD : php -- multiple vulnerabilities (3d675519-5654-11e5-9ad8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2015/9/9	2021/1/6	critical
85886	PHP 5.5.x < 5.5.29 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2025/5/26	high
85887	PHP 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2025/5/26	high
85934	Fedora 22 : php-5.6.13-1.fc22 (2015-14977)	Nessus	Fedora Local Security Checks	2015/9/15	2021/1/11	critical
219089	Linux Distros Unpatched Vulnerability : CVE-2015-6837	Nessus	Misc.	2025/3/4	2025/8/19	high
86030	Fedora 23 : php-5.6.13-1.fc23 (2015-14978)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	critical
91433	F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)	Nessus	F5 Networks Local Security Checks	2016/6/2	2019/4/11	critical
85885	PHP 5.4.x < 5.4.45 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2025/5/26	high
86495	Amazon Linux AMI : php56 (ALAS-2015-601)	Nessus	Amazon Linux Local Security Checks	2015/10/22	2018/4/18	critical
86616	SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)	Nessus	SuSE Local Security Checks	2015/10/27	2021/1/19	high

检测

插件搜索

high

critical

critical

critical

high

high

critical

high

critical

critical

high

critical

high