php5 was updated to fix the following security issues :

  - CVE-2016-6297: Stack-based buffer overflow vulnerability     in php_stream_zip_opener (bsc#991426).

  - CVE-2016-6291: Out-of-bounds access in     exif_process_IFD_in_MAKERNOTE (bsc#991427).

  - CVE-2016-6289: Integer overflow leads to buffer overflow     in virtual_file_ex (bsc#991428).

  - CVE-2016-6290: Use after free in unserialize() with     Unexpected Session Deserialization (bsc#991429).

  - CVE-2016-5399: Improper error handling in bzread()     (bsc#991430).

  - CVE-2016-6288: Buffer over-read in php_url_parse_ex     (bsc#991433).

  - CVE-2016-6296: Heap buffer overflow vulnerability in     simplestring_addn in simplestring.c (bsc#991437).

  - CVE-2016-5769: Mcrypt: Heap Overflow due to integer     overflows (bsc#986388).

  - CVE-2015-8935: XSS in header() with Internet Explorer     (bsc#986004).

  - CVE-2016-5772: Double free corruption in     wddx_deserialize (bsc#986244).

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting in heap overflow (bsc#986386).

  - CVE-2016-5767: Integer Overflow in     gdImagePaletteToTrueColor() resulting in heap overflow     (bsc#986393).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for php is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es) :

* A flaw was found in the way certain error conditions were handled by bzread () function in PHP. An attacker could use this flaw to upload a specially crafted bz2 archive which, when parsed via the vulnerable function, could cause the application to crash or execute arbitrary code with the permissions of the user running the PHP application.
(CVE-2016-5399)

* An integer overflow flaw, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension.
A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted GD2 image.
(CVE-2016-5766)

* An integer overflow flaw, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application using gd via a specially crafted image buffer. (CVE-2016-5767)

* A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)

Red Hat would like to thank Hans Jerry Illikainen for reporting CVE-2016-5399.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote host is affected by the vulnerability described in GLSA-201612-09 (GD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GD. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for php5 fixes the following issues :

  - It is possible to launch a web server with 'php -S     localhost:8080' It used to be possible to set an     arbitrary $HTTP_PROXY environment variable for request     handlers -- like CGI scripts -- by including a specially     crafted HTTP header in the request (CVE-2016-5385). As a     result, these server components would potentially direct     all their outgoing HTTP traffic through a malicious     proxy server. This patch fixes the issue: the updated     php server ignores such HTTP headers and never sets     $HTTP_PROXY for sub-processes. (bnc#988486)

  - There was multiple cases where a remote attacker could     trigger a double free and, given specific PHP code using     callbacks, trigger code execution vectors.
    (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)

  - It was possible to inject header or content information     (XSS) when a user was using internet explorer as the     browser. (bnc#986004, CVE-2015-8935)

  - In several cases it was possible for a integer overflow     to trigger an excessive memory allocation (bnc#986392,     bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770,     CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)

  - It was possible for an attacker to abuse the garbage     collector to free a target array. At this point an     attacker could craft a fake zval object and exploit the     PHP process by taking over the EIP/RIP. (bnc#986391,     CVE-2016-5771)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:5443 advisory.

    GD is an open source code library for the dynamic creation of images by programmers. GD creates PNG, JPEG,     GIF, WebP, XPM, BMP images, among other formats.

    Security Fix(es):

    * gd: Integer overflow in _gd2GetHeader() resulting in heap overflow (CVE-2016-5766)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5443 advisory.

    - Fix CVE-2016-5766

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1577 advisory.

    An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2()     function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or     execute arbitrary code with the privileges of the user running that PHP application, using  gd via a     specially crafted GD2 image. (CVE-2016-5766)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3030-1 advisory.

    It was discovered that the GD library incorrectly handled memory when using gdImageScaleTwoPass(). A     remote attacker could possibly use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS. (CVE-2013-7456)

    It was discovered that the GD library incorrectly handled certain malformed XBM images. If a user or     automated system were tricked into processing a specially crafted XBM image, an attacker could cause a     denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.10 and Ubuntu 16.04 LTS.
    (CVE-2016-5116)

    It was discovered that the GD library incorrectly handled memory when using _gd2GetHeader(). A remote     attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code.
    (CVE-2016-5766)

    It was discovered that the GD library incorrectly handled certain color indexes. A remote attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu     15.10 and Ubuntu 16.04 LTS. (CVE-2016-6128)

    It was discovered that the GD library incorrectly handled memory when encoding a GIF image. A remote     attacker could possibly use this issue to cause a denial of service. (CVE-2016-6161)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A flaw was found in the way certain error conditions     were handled by bzread() function in PHP. An attacker     could use this flaw to upload a specially crafted bz2     archive which, when parsed via the vulnerable function,     could cause the application to crash or execute     arbitrary code with the permissions of the user running     the PHP application. (CVE-2016-5399)

  - An integer overflow flaw, leading to a heap-based buffer     overflow was found in the imagecreatefromgd2() function     of PHP's gd extension. A remote attacker could use this     flaw to crash a PHP application or execute arbitrary     code with the privileges of the user running that PHP     application using gd via a specially crafted GD2 image.
    (CVE-2016-5766)

  - An integer overflow flaw, leading to a heap-based buffer     overflow was found in the gdImagePaletteToTrueColor()     function of PHP's gd extension. A remote attacker could     use this flaw to crash a PHP application or execute     arbitrary code with the privileges of the user running     that PHP application using gd via a specially crafted     image buffer. (CVE-2016-5767)

  - A double free flaw was found in the     mb_ereg_replace_callback() function of php which is used     to perform regex search. This flaw could possibly cause     a PHP application to crash. (CVE-2016-5768)

Additional Changes :

A stack consumption vulnerability in GD in PHP allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.
(CVE-2015-8874)

An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image.
(CVE-2016-5766)

An integer overflow, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted image buffer.
(CVE-2016-5767)

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)

The mcrypt_generic() and mdecrypt_generic() functions are prone to integer overflows, resulting in a heap-based overflow. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5769)

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5770)

A use-after-free vulnerability that can occur when calling unserialize() on untrusted input was discovered. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application if the application unserializes untrusted input. (CVE-2016-5771 , CVE-2016-5773)

A double free can occur in wddx_deserialize() when trying to deserialize malicious XML input from user's request. This flaw could possibly cause a PHP application to crash. (CVE-2016-5772)

It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-5385)

(Updated on 2016-08-17: CVE-2016-5385 was fixed in this release but was not previously part of this errata)

This update for php5 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11143: An invalid free in the WDDX     deserialization of booleanparameters could be used by     attackers able to inject XML for deserialization tocrash     the PHP interpreter. (bsc#1048097)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting could lead to heap overflow (bsc#986386)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from uninitialized data     in gdImageCreateFromGifCtx function could lead to denial     of service (bsc#1050241)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php53 fixes the several issues. These security issues were fixed :

  - CVE-2017-12933: The finish_nested_data function in     ext/standard/var_unserializer.re was prone to a buffer     over-read while unserializing untrusted data.
    Exploitation of this issue could have had an unspecified     impact on the integrity of PHP (bsc#1054430).

  - CVE-2017-11628: Stack-based buffer overflow in the     zend_ini_do_op() function in Zend/zend_ini_parser.c     could have caused a denial of service or potentially     allowed executing code (bsc#1050726).

  - CVE-2017-7890: The GIF decoding function     gdImageCreateFromGifCtx in the GD Graphics Library did     not zero colorMap arrays use. A specially crafted GIF     image could use the uninitialized tables to read ~700     bytes from the top of the stack, potentially disclosing     sensitive information (bsc#1050241).

  - CVE-2016-5766: Integer overflow in the _gd2GetHeader in     the GD Graphics Library (aka libgd) allowed remote     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via crafted chunk dimensions in     an image (bsc#986386).

  - CVE-2017-11145: An error in the date extension's     timelib_meridian parsing code could have been used by     attackers able to supply date strings to leak     information from the interpreter, related to     ext/date/lib/parse_date.c out-of-bounds reads affecting     the php_parse_date function (bsc#1048112).

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could have lead to     information leak [bsc#1048111]

  - CVE-2016-10397: Incorrect handling of various URI     components in the URL parser could have been used by     attackers to bypass hostname-specific URL checks     (bsc#1047454).

  - CVE-2017-11147: The PHAR archive handler could have been     used by attackers supplying malicious archive files to     crash the PHP interpreter or potentially disclose     information due to a buffer over-read in the     phar_parse_pharfile function (bsc#1048094).

  - CVE-2017-11144: The openssl extension PEM sealing code     did not check the return value of the OpenSSL sealing     function, which could have lead to a crash of the PHP     interpreter (bsc#1048096).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93293	SUSE SLES11 Security Update : php5 (SUSE-SU-2016:2080-1)	Nessus	SuSE Local Security Checks	2016/9/2	2026/1/27	critical
94561	RHEL 7 : php (RHSA-2016:2598)	Nessus	Red Hat Local Security Checks	2016/11/4	2026/1/20	critical
95524	GLSA-201612-09 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/12/5	2026/1/15	critical
92714	openSUSE Security Update : php5 (openSUSE-2016-921) (httpoxy)	Nessus	SuSE Local Security Checks	2016/8/4	2026/1/29	critical
144275	RHEL 7 : gd (RHSA-2020:5443)	Nessus	Red Hat Local Security Checks	2020/12/15	2024/11/7	high
144331	Oracle Linux 7 : gd (ELSA-2020-5443)	Nessus	Oracle Linux Local Security Checks	2020/12/16	2024/11/1	high
144807	Amazon Linux 2 : gd (ALAS-2021-1577)	Nessus	Amazon Linux Local Security Checks	2021/1/8	2024/12/11	high
92011	Ubuntu 14.04 LTS / 16.04 LTS : GD library vulnerabilities (USN-3030-1)	Nessus	Ubuntu Local Security Checks	2016/7/12	2025/9/3	critical
95854	Scientific Linux Security Update : php on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/8	critical
92663	Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)	Nessus	Amazon Linux Local Security Checks	2016/8/2	2026/1/29	critical
102966	openSUSE Security Update : php5 (openSUSE-2017-1010)	Nessus	SuSE Local Security Checks	2017/9/6	2025/11/24	critical
103317	SUSE SLES11 Security Update : php53 (SUSE-SU-2017:2522-1)	Nessus	SuSE Local Security Checks	2017/9/19	2025/11/20	critical

检测

插件搜索

critical

critical

critical

critical

high

high

high

critical

critical

critical

critical

critical