The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-144:01 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated web pages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    This package contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP 2.4 Server.
    Security issues fixed with this release:
    CVE-2015-5589
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5590     Stack-based buffer overflow in the phar_fix_filepath function in     ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x     before 5.6.11 allows remote attackers to cause a denial of service or     possibly have unspecified other impact via a large length value, as     demonstrated by mishandling of an e-mail attachment by the imap PHP     extension.
    CVE-2015-6831     Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44,     5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to     execute arbitrary code via vectors involving (1) ArrayObject, (2)     SplObjectStorage, and (3) SplDoublyLinkedList, which are mishandled     during unserialization.
    CVE-2015-6832     Use-after-free vulnerability in the SPL unserialize implementation in     ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and     5.6.x before 5.6.12 allows remote attackers to execute arbitrary code     via crafted serialized data that triggers misuse of an array field.
    CVE-2015-6833     Directory traversal vulnerability in the PharData class in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to write to arbitrary files via a .. (dot dot) in a ZIP     archive entry that is mishandled during an extractTo call.
    CVE-2015-6834
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6835
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6836     The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45,     5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage     headers, which allows remote attackers to execute arbitrary code via     crafted serialized data that triggers a type confusion in the     serialize_function_call function.
    CVE-2015-6837
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-6838
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7803     The phar_get_entry_data function in ext/phar/util.c in PHP before     5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a     denial of service (NULL pointer dereference and application crash) via     a .phar file with a crafted TAR archive entry in which the Link     indicator references a file that does not exist.
    CVE-2015-7804     Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c     in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers     to cause a denial of service (uninitialized pointer dereference and     application crash) by including the / filename in a .zip PHAR archive.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb)

  - Fixed bug #70277 (new DateTimeZone($foo) is ignoring     text after null byte). (cmb) **EXIF:** * Fixed bug     #70385 (Buffer over-read in exif_read_data with TIFF IFD     tag byte value of 32 bytes). (Stas) **hash:** * Fixed     bug #70312 (HAVAL gives wrong hashes in specific cases).
    (letsgolee at naver dot com) **MCrypt:** * Fixed bug     #69833 (mcrypt fd caching not working). (Anatol)
    **Opcache:** * Fixed bug #70237 (Empty while and     do-while segmentation fault with opcode on CLI enabled).
    (Dmitry, Laruence) **PCRE:** * Fixed bug #70232     (Incorrect bump-along behavior with \K and empty string     match). (cmb) * Fixed bug #70345 (Multiple     vulnerabilities related to PCRE functions). (Anatol     Belski) **SOAP:** * Fixed bug #70388 (SOAP     serialize_function_call() type confusion / RCE). (Stas)
    **SPL:** * Fixed bug #70290 (NULL pointer deref     (segfault) in spl_autoload via ob_start). (hugh at     allthethings dot co dot nz) * Fixed bug #70303     (Incorrect constructor reflection for ArrayObject).
    (cmb) * Fixed bug #70365 (Use-after-free vulnerability     in unserialize() with SplObjectStorage). (taoguangchen     at icloud dot com) * Fixed bug #70366 (Use-after-free     vulnerability in unserialize() with     SplDoublyLinkedList). (taoguangchen at icloud dot com)
    **Standard:** * Fixed bug #70052 (getimagesize() fails     for very large and very small WBMP). (cmb) * Fixed bug     #70157 (parse_ini_string() segmentation fault with     INI_SCANNER_TYPED). (Tjerk) **XSLT:** * Fixed bug #69782     (NULL pointer dereference). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP5 script interpreter was updated to fix various security issues :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403] 

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2758-1 advisory.

    It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589)

    It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5590)

    Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

    Sean Heelan discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6832)

    It was discovered that the PHP phar extension incorrectly handled certain archives. A remote attacker     could use this issue to cause files to be placed outside of the destination directory. (CVE-2015-6833)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-6836)

    It was discovered that the PHP XSLTProcessor class incorrectly handled certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-6837)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-004 or 2015-007. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework
  - apache_mod_php
  - ATS
  - Audio
  - CFNetwork
  - CoreGraphics
  - CoreText
  - EFI
  - FontParser
  - Grand Central Dispatch
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - libarchive
  - MCX Application Restrictions
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
291542	MiracleLinux 4 : rh-php56-php-5.6.5-8.AXS4 (AXSA:2016-144:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
85933	Fedora 21 : php-5.6.13-1.fc21 (2015-14976)	Nessus	Fedora Local Security Checks	2015/9/15	2021/1/11	critical
86183	openSUSE Security Update : php5 (openSUSE-2015-609)	Nessus	SuSE Local Security Checks	2015/9/28	2021/1/19	critical
86221	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2758-1)	Nessus	Ubuntu Local Security Checks	2015/10/1	2024/8/27	critical
86223	Slackware 14.0 / 14.1 / current : php (SSA:2015-274-02)	Nessus	Slackware Local Security Checks	2015/10/2	2021/1/14	critical
89967	Amazon Linux AMI : php54 (ALAS-2016-670)	Nessus	Amazon Linux Local Security Checks	2016/3/17	2019/4/11	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
86829	Mac OS X Multiple Vulnerabilities (Security Updates 2015-004 / 2015-007)	Nessus	MacOS X Local Security Checks	2015/11/10	2024/5/28	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical