根據其標題，遠端主機上安裝的 PHP 版本是比 5.3.29 舊的 5.3.x。因此受到以下弱點影響：

- 與處理 DateInterval 物件相關的檔案 'ext/date/lib/parse_iso_intervals.c' 中存在一個堆積型緩衝區溢位錯誤，可導致拒絕服務攻擊。(CVE-2013-6712)

- 存在一個與 Fileinfo 延伸模組、Composite Document Format (CDF) 處理和函式 'cdf_read_short_sector' 相關的邊界檢查錯誤。(CVE-2014-0207)

- 「src/cdf.c」內的「cdf_unpack_summary_info()」函式中存有瑕疵，處理特製的 CDF 檔案時會發生多個 file_printf 呼叫。
 這可導致內容相依的攻擊者使用 PHP 損毀 Web 應用程式。(CVE-2014-0237)

-「src/cdf.c」內的「cdf_read_property_info()」函式中存有瑕疵，處理特製的 CDF 檔案時會發生無限迴圈。這可導致內容相依的攻擊者使用 PHP 損毀 Web 應用程式。(CVE-2014-0238)

- 存在一個與標準 PHP 程式庫 (SPL) 延伸模組和函式「unserialize」相關的類型混淆錯誤。(CVE-2014-3515)

- 存在一個與組態指令碼和暫存檔處理相關的錯誤，可允許不安全的檔案使用方式。(CVE-2014-3981)

- 存在一個與函式「dns_get_record」相關的堆積型緩衝區溢位錯誤，可導致任意程式碼執行。(CVE-2014-4049)

- printf 中存在一個超出邊界讀取問題。(錯誤 #67249)。

請注意，Nessus 並未嘗試惡意利用這些問題，而是僅依據應用程式自我報告的版本號碼。

此外，請注意，版本 5.3.29 標記對 PHP 5.3.x 分支支援的結束。

根據其標題，遠端主機上安裝的 PHP 版本是開發版本 5.6.0 版。因此當處理格式錯誤的 CDF 檔案時，會受到 'fileinfo' 延伸模組之 'libmagic' 程式庫中的一個 NULL 指標解除參照錯誤影響。透過將特製的 CDF 檔案上傳至主機，遠端攻擊者可造成拒絕服務。

請注意，Nessus 並未嘗試惡意利用此問題，而是僅依據應用程式自我報告的版本號碼。

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Admin Framework
 - Apache
 - ATS
 - Certificate Trust Policy
 - CFNetwork HTTPProtocol
 - CFNetwork Session
 - CFURL
 - CoreAnimation
 - FontParser
 - Graphics Driver
 - Hypervisor
 - ImageIO
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libnetcore
 - ntp
 - Open Directory Client
 - OpenLDAP
 - OpenSSL
 - PHP
 - QuickLook
 - SceneKit
 - ScreenSharing
 - Security - Code SIgning
 - UniformTypeIdentifiers
 - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Versions of PHP 5.4.x earlier than 5.4.30, or 5.5.x earlier than 5.5.14 are exposed to the following issues :

  - Boundary checking errors exist related to the Fileinfo extension, Composite Document Format (CDF) handling and the functions 'cdf_read_short_sector', 'cdf_check_stream_offset', 'cdf_count_chain' and 'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)
  - A pascal string size handling error exists related to the Fileinfo extension and the function 'mconvert'. (CVE-2014-3478)
  - A type-confusion error exists related to the Standard PHP Library (SPL) extension and the function 'unserialize'. (CVE-2014-3515)
  - An error exists related to configuration scripts and temporary file handling that could allow insecure file usage. (CVE-2014-3981)
  - A heap-based buffer overflow error exists related to the function 'dns_get_record' that could allow execution of arbitrary code. (CVE-2014-4049)
  - A type-confusion error exists related to the 'php_print_info' function which could allow disclosure of sensitive information. (CVE-2014-4721)
  - An error exists related to the unserialization and 'SplFileObject' handling that could allow denial of service attacks. (Bug 67072)
  - A double free error exists related to the 'Intl' extension and the method 'Locale::parseLocale' having an unspecified impact. (Bug 67349)
  - A buffer overflow error exists related to the 'Intl' extension and the functions 'locale_get_display_name' and 'uloc_getDisplayName' having unspecified impact. (Bug 67397)
  - An out-of-bounds read flaw affects the date_parse_from_format() function in 'ext/date/lib/parse_date.c' that is triggered as date parsing routines fail to check the end of strings. This may allow a remote attacker to crash an application linked against PHP or potentially disclose memory contents. (Bug 67251)
  - An out-of-bounds read flaw affects the timelib_meridian_with_check() function in 'ext/date/lib/parse_date.c' that is triggered as string ends are not properly checked. This may allow a remote attacker to crash an application linked against PHP or potentially disclose memory contents. (Bug 67253)

The remote host is running a version of Mac OS X that is older than 10.9.5, and is thus missing security-related fixes for the following components:

  - Bluetooth
  - CoreGraphics
  - Foundation
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Intel Graphics Driver
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - apache_mod_php
  - ruby

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
77285	PHP 5.3.x < 5.3.29 多個弱點	Nessus	CGI abuses	2014/8/20	2025/5/26	high
78556	PHP 5.6.0 開發版本 CDF 檔案 NULL 指標解除參照 DoS	Nessus	CGI abuses	2014/10/17	2025/5/26	high
93161	SUSE SLES11 安全性更新：php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	2016/8/29	2021/1/19	critical
700510	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical
8320	PHP 5.4.x < 5.4.30 / 5.5.x < 5.5.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2014/7/2	2019/3/6	critical
8394	Mac OS X < 10.9.5 Multiple Vulnerabilities (Security Update 2014-004)	Nessus Network Monitor	Web Clients	2014/9/19	2019/3/6	critical

检测

插件搜索

high

high

critical

critical

critical

critical