The PHP5 script interpreter was updated to fix various security issues :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403] 

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2758-1 advisory.

    It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589)

    It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5590)

    Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

    Sean Heelan discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6832)

    It was discovered that the PHP phar extension incorrectly handled certain archives. A remote attacker     could use this issue to cause files to be placed outside of the destination directory. (CVE-2015-6833)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-6836)

    It was discovered that the PHP XSLTProcessor class incorrectly handled certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-6837)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-004 or 2015-007. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework
  - apache_mod_php
  - ATS
  - Audio
  - CFNetwork
  - CoreGraphics
  - CoreText
  - EFI
  - FontParser
  - Grand Central Dispatch
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - libarchive
  - MCX Application Restrictions
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

It also includes a bugfix for the odbc module :

  - compare with SQL_NULL_DATA correctly [bnc#935074]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.45. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 )

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

As reported upstream, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name '/ZIP' could cause a PHP application function to crash. (CVE-2015-7804)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86183	openSUSE Security Update : php5 (openSUSE-2015-609)	Nessus	SuSE Local Security Checks	2015/9/28	2021/1/19	critical
86221	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2758-1)	Nessus	Ubuntu Local Security Checks	2015/10/1	2024/8/27	critical
86223	Slackware 14.0 / 14.1 / current : php (SSA:2015-274-02)	Nessus	Slackware Local Security Checks	2015/10/2	2021/1/14	critical
89967	Amazon Linux AMI : php54 (ALAS-2016-670)	Nessus	Amazon Linux Local Security Checks	2016/3/17	2019/4/11	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
86829	Mac OS X Multiple Vulnerabilities (Security Updates 2015-004 / 2015-007)	Nessus	MacOS X Local Security Checks	2015/11/10	2024/5/28	critical
86616	SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)	Nessus	SuSE Local Security Checks	2015/10/27	2021/1/19	high
85885	PHP 5.4.x < 5.4.45 Multiple Vulnerabilities	Nessus	CGI abuses	2015/9/10	2025/5/26	high
86495	Amazon Linux AMI : php56 (ALAS-2015-601)	Nessus	Amazon Linux Local Security Checks	2015/10/22	2018/4/18	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

high

high

critical