The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.30. It is, therefore, affected by the following vulnerabilities :

  - Boundary checking errors exist related to the     Fileinfo extension, Composite Document Format (CDF)     handling and the functions 'cdf_read_short_sector',     'cdf_check_stream_offset', 'cdf_count_chain', and     'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479,     CVE-2014-3480, CVE-2014-3487)

  - A pascal string size handling error exists related to     the Fileinfo extension and the function 'mconvert'.
    (CVE-2014-3478)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - A type-confusion error exists related to the function     'php_print_info' that could allow disclosure of     sensitive information. (CVE-2014-4721)

  - An out-of-bounds read error exists in the     timelib_meridian_with_check() function due to a failure     to properly check string ends. A remote attacker can     exploit this to cause a denial of service condition or     to disclose memory contents.

  - An out-of-bounds read error exists in the     date_parse_from_format() function due to a failure     in the date parsing routines to properly check string     ends. A remote attacker can exploit this to cause a     denial of service condition or to disclose memory     contents.

  - An error exists related to unserialization and     'SplFileObject' handling that could allow denial of     service attacks. (Bug #67072)

  - A double free error exists related to the Intl     extension and the method 'Locale::parseLocale' having     unspecified impact. (Bug #67349)

  - A buffer overflow error exists related to the Intl     extension and the functions 'locale_get_display_name'     and 'uloc_getDisplayName' having unspecified impact.
    (Bug #67397)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1606 advisory.

    - fix CVE-2014-3479 (cdf_check_stream_offset boundary check)
    - fix CVE-2014-3480 (cdf_count_chain insufficient boundary check)
    - fix CVE-2014-0237 (cdf_unpack_summary_info() excessive looping DoS)
    - fix CVE-2014-0238 (CDF property info parsing nelements infinite loop)
    - fix CVE-2014-2270 (out-of-bounds access in search rules with offsets)
    - fix CVE-2014-1943 (unrestricted recursion in handling of indirect type rules)
    - fix CVE-2012-1571 (out of bounds read in CDF parser)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated file packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The 'file' command is used to identify a particular file according to the type of data contained in the file. The command can identify various file types, including ELF binaries, system libraries, RPM packages, and different graphics formats.

Multiple denial of service flaws were found in the way file parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash file, or an application using file, via a specially crafted CDF file. (CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2012-1571)

Two denial of service flaws were found in the way file handled indirect and search rules. A remote attacker could use either of these flaws to cause file, or an application using file, to crash or consume an excessive amount of CPU. (CVE-2014-1943, CVE-2014-2270)

This update also fixes the following bugs :

* Previously, the output of the 'file' command contained redundant white spaces. With this update, the new STRING_TRIM flag has been introduced to remove the unnecessary white spaces. (BZ#664513)

* Due to a bug, the 'file' command could incorrectly identify an XML document as a LaTex document. The underlying source code has been modified to fix this bug and the command now works as expected.
(BZ#849621)

* Previously, the 'file' command could not recognize .JPG files and incorrectly labeled them as 'Minix filesystem'. This bug has been fixed and the command now properly detects .JPG files. (BZ#873997)

* Under certain circumstances, the 'file' command incorrectly detected NETpbm files as 'x86 boot sector'. This update applies a patch to fix this bug and the command now detects NETpbm files as expected.
(BZ#884396)

* Previously, the 'file' command incorrectly identified ASCII text files as a .PIC image file. With this update, a patch has been provided to address this bug and the command now correctly recognizes ASCII text files. (BZ#980941)

* On 32-bit PowerPC systems, the 'from' field was missing from the output of the 'file' command. The underlying source code has been modified to fix this bug and 'file' output now contains the 'from' field as expected. (BZ#1037279)

* The 'file' command incorrectly detected text files as 'RRDTool DB version ool - Round Robin Database Tool'. This update applies a patch to fix this bug and the command now correctly detects text files.
(BZ#1064463)

* Previously, the 'file' command supported only version 1 and 2 of the QCOW format. As a consequence, file was unable to detect a 'qcow2 compat=1.1' file created on Red Hat Enterprise Linux 7. With this update, support for QCOW version 3 has been added so that the command now detects such files as expected. (BZ#1067771)

All file users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.29. It is, therefore, affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to handling     DateInterval objects that allows denial of service     attacks. (CVE-2013-6712)

  - A boundary checking error exists related to the Fileinfo     extension, Composite Document Format (CDF) handling, and     the function 'cdf_read_short_sector'. (CVE-2014-0207)

  - A flaw exists with the 'cdf_unpack_summary_info()'     function within 'src/cdf.c' where multiple file_printf     calls occur when handling specially crafted CDF files.
    This could allow a context dependent attacker to crash     the web application using PHP. (CVE-2014-0237)

  - A flaw exists with the 'cdf_read_property_info()'     function within 'src/cdf.c' where an infinite loop     occurs when handling specially crafted CDF files. This     could allow a context dependent attacker to crash the     web application using PHP. (CVE-2014-0238)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - An out-of-bounds read exists in printf. (Bug #67249)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

Additionally, note that version 5.3.29 marks the end of support for the PHP 5.3.x branch.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-484:02 advisory.

    Description :
    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated webpages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    The php package contains the module which adds support for the PHP     language to Apache HTTP Server.
    Security issues fixed with this release:
    CVE-2012-1571     file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted     Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer     dereference.
    CVE-2013-6712     The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict     creation of DateInterval objects, which might allow remote attackers to cause a denial of service (heap-     based buffer over-read) via a crafted interval specification.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x     before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering     many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x     before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-1943     Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite     recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
    CVE-2014-2270     softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in     PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before     5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a crafted CDF file.
    CVE-2014-3515     The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data     structures will have the array data type after unserialization, which allows remote attackers to execute     arbitrary code via a crafted string that triggers use of a Hashtable destructor, related to type     confusion issues in (1) ArrayObject and (2) SPLObjectStorage.
    CVE-2014-4049     Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier     allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a     crafted DNS TXT record, related to the dns_get_record function.
    CVE-2014-4721     The phpinfo implementation in ext/standard/info.c in PHP before 5.4.30 and 5.5.x before 5.5.14 does not     ensure use of the string data type for the PHP_AUTH_PW, PHP_AUTH_TYPE, PHP_AUTH_USER, and PHP_SELF     variables, which might allow context-dependent attackers to obtain sensitive information from process     memory by using the integer data type with crafted values, related to a type confusion vulnerability, as     demonstrated by reading a private SSL key in an Apache HTTP Server web-hosting environment with mod_ssl     and a PHP 5.3.x mod_php.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2276-1 advisory.

    Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A     remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service.
    (CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

    Stefan Esser discovered that PHP incorrectly handled unserializing SPL extension objects. An attacker     could use this issue to execute arbitrary code. (CVE-2014-3515)

    It was discovered that PHP incorrectly handled certain SPL Iterators. An attacker could use this issue to     cause PHP to crash, resulting in a denial of service. (CVE-2014-4670)

    It was discovered that PHP incorrectly handled certain ArrayIterators. An attacker could use this issue to     cause PHP to crash, resulting in a denial of service. (CVE-2014-4698)

    Stefan Esser discovered that PHP incorrectly handled variable types when calling phpinfo(). An attacker     could use this issue to possibly gain access to arbitrary memory, possibly containing sensitive     information. (CVE-2014-4721)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1013 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. PHP's fileinfo module provides functions used to identify a     particular file according to the type of data contained by the file.

    A denial of service flaw was found in the File Information (fileinfo)     extension rules for detecting AWK files. A remote attacker could use this     flaw to cause a PHP application using fileinfo to consume an excessive     amount of CPU. (CVE-2013-7345)

    Multiple denial of service flaws were found in the way the File Information     (fileinfo) extension parsed certain Composite Document Format (CDF) files.
    A remote attacker could use either of these flaws to crash a PHP     application using fileinfo via a specially crafted CDF file.
    (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480,     CVE-2014-3487)

    A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT     records. A malicious DNS server or a man-in-the-middle attacker could     possibly use this flaw to execute arbitrary code as the PHP interpreter if     a PHP application used the dns_get_record() function to perform a DNS     query. (CVE-2014-4049)

    A type confusion issue was found in PHP's phpinfo() function. A malicious     script author could possibly use this flaw to disclose certain portions of     server memory. (CVE-2014-4721)

    A type confusion issue was found in the SPL ArrayObject and     SPLObjectStorage classes' unserialize() method. A remote attacker able to     submit specially crafted input to a PHP application, which would then     unserialize this input using one of the aforementioned methods, could use     this flaw to execute arbitrary code with the privileges of the user running     that PHP application. (CVE-2014-3515)

    The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479,     CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso     of Red Hat Product Security.

    All php users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. After installing the     updated packages, the httpd daemon must be restarted for the update to     take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1013 advisory.

    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237
    - fileinfo: CDF property info parsing nelements infinite       loop. CVE-2014-0238
    - fileinfo: cdf_check_stream_offset insufficient boundary       check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check       CVE-2014-3480
    - fileinfo: cdf_read_short_sector insufficient boundary       check. CVE-2014-0207
    - fileinfo: cdf_read_property_info insufficient boundary       check. CVE-2014-3487
    - fileinfo: fix extensive backtracking CVE-2013-7345
    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - core: fix heap-based buffer overflow in DNS TXT record       parsing. CVE-2014-4049

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.

NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345 .

Fix various denial of service attacks :

CVE-2014-3487

The cdf_read_property_info function does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

CVE-2014-3480

The cdf_count_chain function in cdf.c in does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.

CVE-2014-3479

The cdf_check_stream_offset function in cdf.c relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.

CVE-2014-3478

Buffer overflow in the mconvert function in softmagic.c allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

CVE-2014-0238

The cdf_read_property_info function in cdf.c allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.

CVE-2014-0237

The cdf_unpack_summary_info function in cdf.c allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.

CVE-2014-0207

The cdf_read_short_sector function in cdf.c allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-614:01 advisory.

    Description :
    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2012-1571     file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted     Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer     dereference.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x     before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering     many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x     before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-1943     Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite     recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.
    CVE-2014-2270     softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in     PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before     5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a crafted CDF file.
    Fixed bugs:
    This update contain a number of bug fixes and enhancements over the previous version.
    Please see changelog for more information.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated php packages fix security vulnerabilities :

The unserialize() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue related to the SPL ArrayObject and SPLObjectStorage Types (CVE-2014-3515).

It was discovered that PHP is vulnerable to a heap-based buffer overflow in the DNS TXT record parsing. A malicious server or man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application uses dns_get_record() to perform a DNS query (CVE-2014-4049).

A flaw was found in the way file parsed property information from Composite Document Files (CDF) files, where the mconvert() function did not correctly compute the truncated pascal string size (CVE-2014-3478).

Multiple flaws were found in the way file parsed property information from Composite Document Files (CDF) files, due to insufficient boundary checks on buffers (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487).

PHP contains a bundled copy of the file utility's libmagic library, so it was vulnerable to this issue. It has been updated to versions 5.5.14, which fix this issue and several other bugs.

The phpinfo() function in PHP before 5.4.30 and 5.5.14 has a Type Confusion issue that can cause it to leak arbitrary process memory (CVE-2014-4721).

Additionally, php-apc has been rebuilt against the updated php packages and the php-timezonedb packages has been upgraded to the 2014.5 version.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1012 advisory.

    - core: type confusion issue in phpinfo(). CVE-2014-4721
    - date: fix heap-based buffer over-read in DateInterval. CVE-2013-6712
    - core: fix heap-based buffer overflow in DNS TXT record parsing.
      CVE-2014-4049
    - core: unserialize() SPL ArrayObject / SPLObjectStorage type       confusion flaw. CVE-2014-3515
    - fileinfo: out-of-bounds memory access in fileinfo. CVE-2014-2270
    - fileinfo: unrestricted recursion in handling of indirect type       rules. CVE-2014-1943
    - fileinfo: out of bounds read in CDF parser. CVE-2012-1571
    - fileinfo: cdf_check_stream_offset boundary check. CVE-2014-3479
    - fileinfo: cdf_count_chain insufficient boundary check. CVE-2014-3480
    - fileinfo: cdf_unpack_summary_info() excessive looping       DoS. CVE-2014-0237

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-693:01 advisory.

    The file command is used to identify a particular file according to the     type of data contained by the file.  File can identify many different     file types, including ELF binaries, system libraries, RPM packages, and     different graphics formats.
    Security issues fixed with this release:
    CVE-2014-0207     The cdf_read_short_sector function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, allows remote attackers to cause a denial of service     (assertion failure and application exit) via a crafted CDF file.
    CVE-2014-0237     The cdf_unpack_summary_info function in cdf.c in the Fileinfo     component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote     attackers to cause a denial of service (performance degradation) by     triggering many file_printf calls.
    CVE-2014-0238     The cdf_read_property_info function in cdf.c in the Fileinfo component     in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers     to cause a denial of service (infinite loop or out-of-bounds memory     access) via a vector that (1) has zero length or (2) is too long.
    CVE-2014-3478     Buffer overflow in the mconvert function in softmagic.c in file before     5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x     before 5.5.14, allows remote attackers to cause a denial of service     (application crash) via a crafted Pascal string in a FILE_PSTRING     conversion.
    CVE-2014-3479     The cdf_check_stream_offset function in cdf.c in file before 5.19, as     used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before     5.5.14, relies on incorrect sector-size data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted stream offset in a CDF file.
    CVE-2014-3480     The cdf_count_chain function in cdf.c in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate sector-count data, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3487     The cdf_read_property_info function in file before 5.19, as used in     the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14,     does not properly validate a stream offset, which allows remote     attackers to cause a denial of service (application crash) via a     crafted CDF file.
    CVE-2014-3538     file before 5.19 does not properly restrict the amount of data read     during a regex search, which allows remote attackers to cause a denial     of service (CPU consumption) via a crafted file that triggers     backtracking during processing of an awk rule.  NOTE: this     vulnerability exists because of an incomplete fix for CVE-2013-7345.
    CVE-2014-3587     Integer overflow in the cdf_read_property_info function in cdf.c in     file through 5.19, as used in the Fileinfo component in PHP before     5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a     denial of service (application crash) via a crafted CDF file.  NOTE:
    this vulnerability exists because of an incomplete fix for     CVE-2012-1571.
    CVE-2014-3710     The donote function in readelf.c in file through 5.20, as used in the     Fileinfo component in PHP 5.4.34, does not ensure that sufficient note     headers are present, which allows remote attackers to cause a denial     of service (out-of-bounds read and application crash) via a crafted     ELF file.
    CVE-2014-8116     The ELF parser (readelf.c) in file before 5.21 allows remote attackers     to cause a denial of service (CPU consumption or crash) via a large     number of (1) program or (2) section headers or (3) invalid     capabilities.
    CVE-2014-8117     softmagic.c in file before 5.21 does not properly limit recursion,     which allows remote attackers to cause a denial of service (CPU     consumption or crash) via unspecified vectors.
    CVE-2014-9652     The mconvert function in softmagic.c in file before 5.21, as used in     the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and     5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which     might allow remote attackers to cause a denial of service     (out-of-bounds memory access and application crash) via a crafted     file.
    CVE-2014-9653     readelf.c in file before 5.22, as used in the Fileinfo component in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does     not consider that pread calls sometimes read only a subset of the     available data, which allows remote attackers to cause a denial of     service (uninitialized memory access) or possibly have unspecified     other impact via a crafted ELF file.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2014-0207     Francisco Alonso of the Red Hat Security Response Team     reported an incorrect boundary check in the     cdf_read_short_sector() function.

  - CVE-2014-3478     Francisco Alonso of the Red Hat Security Response Team     discovered a flaw in the way the truncated pascal string     size in the mconvert() function is computed.

  - CVE-2014-3479     Francisco Alonso of the Red Hat Security Response Team     reported an incorrect boundary check in the     cdf_check_stream_offset() function.

  - CVE-2014-3480     Francisco Alonso of the Red Hat Security Response Team     reported an insufficient boundary check in the     cdf_count_chain() function.

  - CVE-2014-3487     Francisco Alonso of the Red Hat Security Response Team     discovered an incorrect boundary check in the     cdf_read_property_info() funtion.

  - CVE-2014-3515     Stefan Esser discovered that the ArrayObject and the     SPLObjectStorage unserialize() handler do not verify the     type of unserialized data before using it. A remote     attacker could use this flaw to execute arbitrary code.

  - CVE-2014-4721     Stefan Esser discovered a type confusion issue affecting     phpinfo(), which might allow an attacker to obtain     sensitive information from process memory.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. PHP's fileinfo module provides functions used to identify a particular file according to the type of data contained by the file.

A denial of service flaw was found in the File Information (fileinfo) extension rules for detecting AWK files. A remote attacker could use this flaw to cause a PHP application using fileinfo to consume an excessive amount of CPU. (CVE-2013-7345)

Multiple denial of service flaws were found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use either of these flaws to crash a PHP application using fileinfo via a specially crafted CDF file. (CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query. (CVE-2014-4049)

A type confusion issue was found in PHP's phpinfo() function. A malicious script author could possibly use this flaw to disclose certain portions of server memory. (CVE-2014-4721)

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2014-3515)

The CVE-2014-0207, CVE-2014-0237, CVE-2014-0238, CVE-2014-3479, CVE-2014-3480, and CVE-2014-3487 issues were discovered by Francisco Alonso of Red Hat Product Security.

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components :

  - apache_mod_php
  - Bluetooth
  - CoreGraphics
  - Foundation
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - ruby

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	2015/4/10	2024/5/28	critical
76281	PHP 5.4.x < 5.4.30 Multiple Vulnerabilities	Nessus	CGI abuses	2014/6/27	2025/5/26	high
78527	Oracle Linux 6 : file (ELSA-2014-1606)	Nessus	Oracle Linux Local Security Checks	2014/10/17	2025/4/29	high
79185	CentOS 6 : file (CESA-2014:1606)	Nessus	CentOS Local Security Checks	2014/11/12	2021/1/4	medium
77285	PHP 5.3.x < 5.3.29 Multiple Vulnerabilities	Nessus	CGI abuses	2014/8/20	2025/5/26	high
289053	MiracleLinux 4 : php-5.3.3-27.AXS4.1 (AXSA:2014-484:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
76451	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2276-1)	Nessus	Ubuntu Local Security Checks	2014/7/10	2024/8/27	critical
77016	RHEL 7 : php (RHSA-2014:1013)	Nessus	Red Hat Local Security Checks	2014/8/6	2025/3/20	high
77044	Oracle Linux 7 : php (ELSA-2014-1013)	Nessus	Oracle Linux Local Security Checks	2014/8/7	2024/10/23	critical
78325	Amazon Linux AMI : file (ALAS-2014-382)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
82175	Debian DLA-27-1 : file security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
289706	MiracleLinux 4 : file-5.04-21.AXS4 (AXSA:2014-614:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
76438	Mandriva Linux Security Advisory : php (MDVSA-2014:130)	Nessus	Mandriva Local Security Checks	2014/7/10	2021/1/6	high
77043	Oracle Linux 5 / 6 : php53 / and / php (ELSA-2014-1012)	Nessus	Oracle Linux Local Security Checks	2014/8/7	2024/10/22	medium
289920	MiracleLinux 7 : file-5.11-31.el7 (AXSA:2015-693:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
76418	Debian DSA-2974-1 : php5 - security update	Nessus	Debian Local Security Checks	2014/7/9	2021/1/11	high
77033	CentOS 7 : php (CESA-2014:1013)	Nessus	CentOS Local Security Checks	2014/8/7	2021/1/4	high
77748	Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2014/9/18	2024/5/28	critical

检测

插件搜索

critical

high

high

medium

high

high

critical

high

critical

medium

medium

high

high

medium

high

high

high

critical