This update for php5 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11143: An invalid free in the WDDX     deserialization of booleanparameters could be used by     attackers able to inject XML for deserialization tocrash     the PHP interpreter. (bsc#1048097)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting could lead to heap overflow (bsc#986386)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from uninitialized data     in gdImageCreateFromGifCtx function could lead to denial     of service (bsc#1050241)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5443 advisory.

    GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG,     GIF, WebP, XPM, BMP images, among other formats.

    Security Fix(es):

    * gd: Integer overflow in _gd2GetHeader() resulting in heap overflow (CVE-2016-5766)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5443 advisory.

    - Fix CVE-2016-5766

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1577 advisory.

    An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2()     function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or     execute arbitrary code with the privileges of the user running that PHP application, using  gd via a     specially crafted GD2 image. (CVE-2016-5766)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3030-1 advisory.

    It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2013-7456)

    It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or     automated system were tricked into processing a specially crafted XBM image, an attacker could cause a     denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.
    (CVE-2016-5116)

    It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-5766)

    It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

    It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote     attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A stack consumption vulnerability in GD in PHP allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.
(CVE-2015-8874)

An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image.
(CVE-2016-5766)

An integer overflow, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted image buffer.
(CVE-2016-5767)

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)

The mcrypt_generic() and mdecrypt_generic() functions are prone to integer overflows, resulting in a heap-based overflow. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5769)

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5770)

A use-after-free vulnerability that can occur when calling unserialize() on untrusted input was discovered. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application if the application unserializes untrusted input. (CVE-2016-5771 , CVE-2016-5773)

A double free can occur in wddx_deserialize() when trying to deserialize malicious XML input from user's request. This flaw could possibly cause a PHP application to crash. (CVE-2016-5772)

It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-5385)

(Updated on 2016-08-17: CVE-2016-5385 was fixed in this release but was not previously part of this errata)

Security Fix(es) :

  - A flaw was found in the way certain error conditions     were handled by bzread() function in PHP. An attacker     could use this flaw to upload a specially crafted bz2     archive which, when parsed via the vulnerable function,     could cause the application to crash or execute     arbitrary code with the permissions of the user running     the PHP application. (CVE-2016-5399)

  - An integer overflow flaw, leading to a heap-based buffer     overflow was found in the imagecreatefromgd2() function     of PHP's gd extension. A remote attacker could use this     flaw to crash a PHP application or execute arbitrary     code with the privileges of the user running that PHP     application using gd via a specially crafted GD2 image.
    (CVE-2016-5766)

  - An integer overflow flaw, leading to a heap-based buffer     overflow was found in the gdImagePaletteToTrueColor()     function of PHP's gd extension. A remote attacker could     use this flaw to crash a PHP application or execute     arbitrary code with the privileges of the user running     that PHP application using gd via a specially crafted     image buffer. (CVE-2016-5767)

  - A double free flaw was found in the     mb_ereg_replace_callback() function of php which is used     to perform regex search. This flaw could possibly cause     a PHP application to crash. (CVE-2016-5768)

Additional Changes :

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has gd packages installed that are affected by a vulnerability:

  - Integer overflow in the _gd2GetHeader function in gd_gd2.c in the GD Graphics Library (aka libgd) before     2.2.3, as used in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8, allows remote attackers to     cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified     other impact via crafted chunk dimensions in an image. (CVE-2016-5766)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

**Version 2.2.2**

Security related fixes :

  - Integer Overflow in gdImagePaletteToTrueColor()     resulting in heap overflow (CVE-2016-5767)

  - Stack overflow with gdImageFillToBorder (CVE-2015-8874)

  - Integer Overflow in _gd2GetHeader() resulting in heap     overflow (CVE-2016-5766)

  - NULL pointer Dereference at _gdScaleVert

  - Integer Overflow in gdImagePaletteToTrueColor() in heap     overflow

Numerous other fixes have been applied. The scale and rotation functions have been greatly improved as well.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libgd2, a library for programmatic graphics creation and manipulation. A remote attacker can take advantage of these flaws to cause a denial-of-service against an application using the libgd2 library (application crash), or potentially to execute arbitrary code with the privileges of the user running the application.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.8. It is, therefore, affected by multiple vulnerabilities :

  - An invalid free flaw exists in the phar_extract_file()     function within file ext/phar/phar_object.c that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2016-4473)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in the nl2br()     function within file ext/standard/string.c when handling     new_length values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

23 Jun 2016, **PHP 5.6.23**

**Core:**

  - Fixed bug php#72275 (Integer Overflow in     json_encode()/json_decode()/json_utf8_to_utf16()).
    (Stas)

  - Fixed bug php#72400 (Integer Overflow in     addcslashes/addslashes). (Stas)

  - Fixed bug php#72403 (Integer Overflow in Length of     String-typed ZVAL). (Stas)

**GD:**

  - Fixed bug php#72298 (pass2_no_dither out-of-bounds     access). (Stas)

  - Fixed bug php#72337 (invalid dimensions can lead to     crash) (Pierre)

  - Fixed bug php#72339 (Integer Overflow in _gd2GetHeader()     resulting in heap overflow). (Pierre)

  - Fixed bug php#72407 (NULL pointer Dereference at
    _gdScaleVert). (Stas)

  - Fixed bug php#72446 (Integer Overflow in     gdImagePaletteToTrueColor() resulting in heap overflow).
    (Pierre)

**Intl:**

  - Fixed bug php#70484 (selectordinal doesn't work with     named parameters). (Anatol)

**mbstring:**

  - Fixed bug php#72402 (_php_mb_regex_ereg_replace_exec -     double free). (Stas)

**mcrypt:**

  - Fixed bug php#72455 (Heap Overflow due to integer     overflows). (Stas)

**Phar:**

  - Fixed bug php#72321 (invalid free in     phar_extract_file()). (hji at dyntopia dot com)

**SPL:**

  - Fixed bug php#72262 (int/size_t confusion in     SplFileObject::fread). (Stas)

  - Fixed bug php#72433 (Use After Free Vulnerability in     PHP's GC algorithm and unserialize). (Dmitry)

**OpenSSL:**

  - Fixed bug php#72140 (segfault after calling     ERR_free_strings()). (Jakub Zelenka)

**WDDX:**

  - Fixed bug php#72340 (Double Free Courruption in     wddx_deserialize). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2598 advisory.

    - bz2: fix improper error handling in bzread() CVE-2016-5399
    - gd: fix integer overflow in _gd2GetHeader() resulting in       heap overflow CVE-2016-5766
    - gd: fix integer overflow in gdImagePaletteToTrueColor()       resulting in heap overflow CVE-2016-5767
    - mbstring: fix double free in _php_mb_regex_ereg_replace_exec       CVE-2016-5768
    - don't set environmental variable based on user supplied Proxy       request header CVE-2016-5385

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way certain error conditions     were handled by bzread() function in PHP. An attacker     could use this flaw to upload a specially crafted bz2     archive which, when parsed via the vulnerable function,     could cause the application to crash or execute     arbitrary code with the permissions of the user running     the PHP application.(CVE-2016-5399)

  - An integer overflow flaw, leading to a heap-based     buffer overflow was found in the imagecreatefromgd2()     function of PHP's gd extension. A remote attacker could     use this flaw to crash a PHP application or execute     arbitrary code with the privileges of the user running     that PHP application using gd via a specially crafted     GD2 image.(CVE-2016-5766)

  - An integer overflow flaw, leading to a heap-based     buffer overflow was found in the     gdImagePaletteToTrueColor() function of PHP's gd     extension. A remote attacker could use this flaw to     crash a PHP application or execute arbitrary code with     the privileges of the user running that PHP application     using gd via a specially crafted image     buffer.(CVE-2016-5767)

  - A double free flaw was found in the     mb_ereg_replace_callback() function of php which is     used to perform regex search. This flaw could possibly     cause a PHP application to crash.(CVE-2016-5768)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102966	openSUSE Security Update : php5 (openSUSE-2017-1010)	Nessus	SuSE Local Security Checks	2017/9/6	2025/11/24	critical
144275	RHEL 7 : gd (RHSA-2020:5443)	Nessus	Red Hat Local Security Checks	2020/12/15	2024/11/7	high
144331	Oracle Linux 7 : gd (ELSA-2020-5443)	Nessus	Oracle Linux Local Security Checks	2020/12/16	2024/11/1	high
144807	Amazon Linux 2 : gd (ALAS-2021-1577)	Nessus	Amazon Linux Local Security Checks	2021/1/8	2024/12/11	high
92011	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3030-1)	Nessus	Ubuntu Local Security Checks	2016/7/12	2025/9/3	critical
92663	Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)	Nessus	Amazon Linux Local Security Checks	2016/8/2	2026/1/29	critical
95854	Scientific Linux Security Update : php on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/8	critical
154443	NewStart CGSL CORE 5.05 / MAIN 5.05 : gd Vulnerability (NS-SA-2021-0182)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2023/11/27	high
92275	Fedora 24 : gd (2016-a4d48d6fd6)	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	high
92327	Debian DSA-3619-1 : libgd2 - security update	Nessus	Debian Local Security Checks	2016/7/18	2026/2/2	critical
91899	PHP 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus	CGI abuses	2016/7/1	2026/1/22	critical
92300	Fedora 24 : php (2016-ec372bddb9)	Nessus	Fedora Local Security Checks	2016/7/15	2026/2/2	critical
94717	Oracle Linux 7 : php (ELSA-2016-2598)	Nessus	Oracle Linux Local Security Checks	2016/11/11	2024/10/22	critical
99825	EulerOS 2.0 SP1 : php (EulerOS-SA-2016-1063)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	critical

检测

插件搜索

critical

high

high

high

critical

critical

critical

high

high

critical

critical

critical

critical

critical