遠端主機執行的 Mac OS X 10.9.5 或 10.10.5 版缺少安全性更新 2016-004。因此受到下列元件中的多個弱點影響：

- apache_mod_php (僅影響 10.10.5)
 - CoreGraphics
 - ImageIO
 - libxml2
 - libxslt

請注意，如果成功惡意利用多數嚴重問題，將會導致任意程式碼執行。

此 php53 更新可修正下列問題：

- CVE-2016-5093：一個 get_icu_value_internal 超出邊界讀取可能會損毀 php 解譯器 (bsc#982010)

- CVE-2016-5094、CVE-2016-5095：不允許建立長度超出 int 範圍的字串，以避免溢位 (bsc#982011、bsc#982012)

- CVE-2016-5096：fread 中的一個 int/size_t 混淆可造成損毀的記憶體 (bsc#982013)

- CVE-2016-5114：fpm_log.c 記憶體洩漏和緩衝區溢位可能會導致資訊洩漏至 php 處理程序之外，或覆寫緩衝區 1 個位元組 (bsc#982162)

- CVE-2016-4346：ext/standard/string.c 中的一個堆積溢位 (bsc#977994)

- CVE-2016-4342：修正了 tar/zip/phar 剖析器中的一個堆積損毀 (bsc#977991)

- CVE-2016-4537、CVE-2016-4538：bcpowmod 接受負比例而造成堆積緩衝區溢位，進而損毀 _one_ definition (bsc#978827)

- CVE-2016-4539：格式錯誤的輸入造成 xml_parse_into_struct() 函式中發生分割錯誤問題 (bsc#978828)

- CVE-2016-4540、CVE-2016-4541：指定負位移時 zif_grapheme_stripos 中發生超出邊界記憶體讀取問題 (bsc#978829)

- CVE-2016-4542、CVE-2016-4543、CVE-2016-4544：
格式錯誤的輸入造成 exif_read_data() 中發生超出邊界堆積記憶體讀取問題 (bsc#978830)

- CVE-2015-4116：spl_ptr_heap_insert 函式中有釋放後使用弱點 (bsc#980366)

- CVE-2015-8873：Zend/zend_exceptions.c 中有堆疊消耗弱點 (bsc#980373)

- CVE-2015-8874：GD 中有堆疊消耗弱點 (bsc#980375)

- CVE-2015-8879：ext/odbc/php_odbc.c 中的 dbc_bindcols 函式不當處理 SQL_WVARCHAR 的驅動程式行為 (bsc#981050)

之前也已在 SUSE Linux Enterprise 11 SP4 上修正，但尚未隨附於 SUSE Linux Enterprise Server 11 SP3 LTSS：

- CVE-2015-8838：mysqlnd 容易遭受 BACKRONYM 攻擊 (bnc#973792)。

- CVE-2015-8835：SoapClient s_call 方法受到類型混淆問題影響，可導致當機 [bsc#973351]

- CVE-2016-2554：phar_get_fp_offset 中的 NULL 指標解除參照問題可導致當機。[bsc#968284]

- CVE-2015-7803：解壓縮 tar phar 封存時存有一個堆疊溢位弱點，其可能導致程式碼執行。[bsc#949961]

- CVE-2016-3141：WDDX 還原序列化中的釋放後使用 / 重複釋放問題可導致當機或可能執行程式碼。[bsc#969821]

- CVE-2016-3142：phar_parse_zipfile() 中的超出邊界讀取問題可導致當機。[bsc#971912]

- CVE-2014-9767：已修正解壓縮 zip 檔案時發生的目錄遊走問題，其可導致覆寫檔案。
 [bsc#971612]

- CVE-2016-3185：make_http_soap_request() 中的類型混淆弱點可導致當機或可能執行程式碼。[bsc#971611]

- CVE-2016-4073：由於錯誤處理 mb_strcut() 中的字串長度計算，遠端攻擊者可藉此造成拒絕服務，或可能執行任意程式碼 (bsc#977003)

- CVE-2015-8867：PHP 函式 openssl_random_pseudo_bytes() 未傳回以密碼編譯方式保護安全的隨機位元組 (bsc#977005)

- CVE-2016-4070：libxml_disable_entity_loader() 設定會在執行緒之間分享，其可導致 XML 外部實體插入和實體擴充問題 (bsc#976997)

- CVE-2015-8866：由於錯誤處理 php_raw_url_encode() 中的大型字串，遠端攻擊者可藉此造成拒絕服務 (bsc#976996)

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

根據其自我報告的版本號碼，遠端 pfSense 安裝版本比 2.3.1-p5 舊。因此受到多個弱點影響，如提及的供應商公告中所述。

Versions of PHP 5.5.x prior to 5.5.37, or 5.6.x prior to 5.6.23, or 7.0.x prior to 7.0.8 are vulnerable to the following issues :

 - PHP 'ext/mysqlnd/mysqlnd.c' contains a flaw that is due to the program failing to properly enforce the requirement of an SSL/TLS connection when the '--ssl client' option is used. This may allow a MitM (Man-in-the-Middle) attacker to downgrade the connection to plain HTTP when expected to be HTTPS. (CVE-2015-8838)
 - An integer overflow condition exists in the 'getFromIndex()'' and 'getFromName()' methods of 'ZipArchive'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted ZIP file. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3078)
 - An XXE (Xml eXternal Entity) injection and expansion flaw affects the 'libxml_disable_entity_loader()' function in the source file 'ext/libxml/libxml.c' in PHP-FPM that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to sensitive information or cause a denial of service. (CVE-2015-8866)
 - An integer overflow condition exists in the 'php_filter_encode_url()' function in 'ext/filter/sanitizing_filters.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4345)
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4346)
 - The program contains an out-of-bounds read flaw in 'ext/intl/grapheme/grapheme_string.c' that is triggered when handling negative offsets in 'zif_grapheme_stripos'. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4540, CVE-2016-4541)
 - An out-of-bounds read flaw exists in the 'php_str2num()' function in 'ext/bcmath/bcmath.c' that is triggered when accepting negative scales. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4537, CVE-2016-4538)
 - An out-of-bounds read flaw exists in the 'exif_read_data()' function in 'ext/exif/exif.c' that is triggered when handling exif headers. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
 - A flaw in the 'xml_parse_into_struct()' function in 'ext/xml/xml.c' is triggered during the handling of a specially crafted XML content. This may allow a remote attacker to cause a denial of service. (CVE-2016-4539)
 - A double-free flaw exists in the 'php_formatted_print()' function in 'ext/standard/formatted_print.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-8880)
 - A flaw exists in 'main/php_open_temporary_file.c' that is triggered as thread safety is not ensured during the handling of temporary directories. This may allow a remote attacker to cause a denial of service. (CVE-2015-8878)
 - An integer overflow flaw exists in the 'php_html_entities()' and 'php_filter_full_special_chars()' functions in 'ext/standard/html.c' that is triggered as input is not properly validated. This may allow a remote attacker to have an unspecified impact. No further details have been provided. (CVE-2016-5094, CVE-2016-5095)
 - An integer underflow issue exists in 'ext/standard/file.c' that is triggered as input is not properly validated. This may allow a remote attacker to cause a NULL write and cause a process linked against PHP to crash. (CVE-2016-5096)
 - An out-of-bounds read flaw exists in the '_gdContributionsCalc()' function in 'ext/gd/libgd/gd_interpolation.c'. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2013-7456)
 - An out-of-bounds read flaw exists in the 'get_icu_value_internal()' function within 'ext/intl/locale/locale_methods.c' that is triggered when handling user-supplied input. This may allow a remote attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-5093)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'header()' function does not filter input passed via HTTP headers before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8935)
 - A use-after-free error exists in the garbage collection algorithm in 'ext/zip/php_zip.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5773)
 - An integer overflow condition exists in the 'json_decode()' and 'json_utf8_to_utf16()' functions in 'ext/standard/php_smart_str.h'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.
 - An out-of-bounds read flaw exists within the 'pass2_no_dither()' function inside 'ext/gd/libgd/gd_topal.c' that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw exists within the '_php_mb_regex_ereg_replace_exec()' function inside 'ext/mbstring/php_mbregex.c' that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)
 - An integer overflow condition exists in 'ext/spl/spl_directory.c'. The issue is triggered by an 'int/size_t' confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)
 - An integer overflow condition exists in 'ext/mcrypt/mcrypt.c'. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)
 - An integer overflow condition exists within the 'nl2br()' function inside 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.
 - An integer overflow condition exists within multiple functions in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw within the 'php_wddx_process_data()' function inside 'ext/wddx/wddx.c' that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)
 - An integer overflow condition exists witin the 'gdImagePaletteToTrueColor()' function inside 'ext/gd/libgd/gd.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)
 - An invalid free flaw exists within the 'phar_extract_file()' function inside 'ext/phar/phar_object.c'. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)
 - An integer overflow condition exists within the '_gd2GetHeader()' function inside 'ext/gd/libgd/gd_gd2.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)
 - A use-after-free error exists within the garbage collection algorithm inside 'ext/spl/spl_array.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5771)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
92497	Mac OS X 10.9.5 和 10.10.5 多個弱點 (安全性更新 2016-004)	Nessus	MacOS X Local Security Checks	2016/7/21	2024/5/28	critical
91665	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1581-1)	Nessus	SuSE Local Security Checks	2016/6/17	2021/1/19	critical
106502	pfSense < 2.3.1-p5 多個弱點 (SA-16_07 / SA-16_08)	Nessus	Firewalls	2018/1/31	2018/12/7	high
9393	PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2016/7/13	2019/3/6	high

检测

插件搜索

critical

critical

high

high