acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Admin Framework
 - Apache
 - ATS
 - Certificate Trust Policy
 - CFNetwork HTTPProtocol
 - CFNetwork Session
 - CFURL
 - CoreAnimation
 - FontParser
 - Graphics Driver
 - Hypervisor
 - ImageIO
 - IOHIDFamily
 - Kernel
 - LaunchServices
 - libnetcore
 - ntp
 - Open Directory Client
 - OpenLDAP
 - OpenSSL
 - PHP
 - QuickLook
 - SceneKit
 - ScreenSharing
 - Security - Code SIgning
 - UniformTypeIdentifiers
 - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-004. It is, therefore, affected multiple vulnerabilities in the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - Security - Code SIgning
  - UniformTypeIdentifiers

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.3. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - Apache
  - ATS
  - Certificate Trust Policy
  - CFNetwork HTTPProtocol
  - CFNetwork Session
  - CFURL
  - CoreAnimation
  - FontParser
  - Graphics Driver
  - Hypervisor
  - ImageIO
  - IOHIDFamily
  - Kernel
  - LaunchServices
  - libnetcore
  - ntp
  - Open Directory Client
  - OpenLDAP
  - OpenSSL
  - PHP
  - QuickLook
  - SceneKit
  - ScreenSharing
  - Security - Code SIgning
  - UniformTypeIdentifiers
  - WebKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its banner, the version of PHP installed on the remote host is a development version of 5.6.0. It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

A buffer over-read flaw was found in the way the DateInterval class parsed interval specifications. An attacker able to make a PHP application parse a specially crafted specification using DateInterval could possibly cause the PHP interpreter to crash.

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query.

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file.

A denial of service flaw was found in the way the File Information (fileinfo) extension parsed certain Composite Document Format (CDF) files. A remote attacker could use this flaw to crash a PHP application using fileinfo via a specially crafted CDF file.

A type confusion issue was found in the SPL ArrayObject and SPLObjectStorage classes' unserialize() method. A remote attacker able to submit specially crafted input to a PHP application, which would then unserialize this input using one of the aforementioned methods, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application.

Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.

A heap-based buffer overflow flaw was found in the way PHP parsed DNS TXT records. A malicious DNS server or a man-in-the-middle attacker could possibly use this flaw to execute arbitrary code as the PHP interpreter if a PHP application used the dns_get_record() function to perform a DNS query.

The remote host is running a version of Mac OS X that is older than 10.9.5, and is thus missing security-related fixes for the following components:

  - Bluetooth
  - CoreGraphics
  - Foundation
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Intel Graphics Driver
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - apache_mod_php
  - ruby

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components :

  - apache_mod_php
  - Bluetooth
  - CoreGraphics
  - Foundation
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - Kernel
  - Libnotify
  - OpenSSL
  - QT Media Foundation
  - ruby

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201408-11 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker can cause arbitrary code execution, create       a Denial of Service condition, read or write arbitrary files, impersonate       other servers, hijack a web session, or have other unspecified impact.
      Additionally, a local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.29. It is, therefore, affected by the following vulnerabilities :

  - A heap-based buffer overflow error exists in the file     'ext/date/lib/parse_iso_intervals.c' related to handling     DateInterval objects that allows denial of service     attacks. (CVE-2013-6712)

  - A boundary checking error exists related to the Fileinfo     extension, Composite Document Format (CDF) handling, and     the function 'cdf_read_short_sector'. (CVE-2014-0207)

  - A flaw exists with the 'cdf_unpack_summary_info()'     function within 'src/cdf.c' where multiple file_printf     calls occur when handling specially crafted CDF files.
    This could allow a context dependent attacker to crash     the web application using PHP. (CVE-2014-0237)

  - A flaw exists with the 'cdf_read_property_info()'     function within 'src/cdf.c' where an infinite loop     occurs when handling specially crafted CDF files. This     could allow a context dependent attacker to crash the     web application using PHP. (CVE-2014-0238)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - An out-of-bounds read exists in printf. (Bug #67249)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

Additionally, note that version 5.3.29 marks the end of support for the PHP 5.3.x branch.

The PHP Team reports :

insecure temporary file use in the configure script

unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion

Heap buffer over-read in DateInterval

fileinfo: cdf_read_short_sector insufficient boundary check

fileinfo: CDF infinite loop in nelements DoS

fileinfo: fileinfo: numerous file_printf calls resulting in performance degradation)

Fix potential segfault in dns_check_record()

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

Versions of PHP 5.4.x earlier than 5.4.30, or 5.5.x earlier than 5.5.14 are exposed to the following issues :

  - Boundary checking errors exist related to the Fileinfo extension, Composite Document Format (CDF) handling and the functions 'cdf_read_short_sector', 'cdf_check_stream_offset', 'cdf_count_chain' and 'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)
  - A pascal string size handling error exists related to the Fileinfo extension and the function 'mconvert'. (CVE-2014-3478)
  - A type-confusion error exists related to the Standard PHP Library (SPL) extension and the function 'unserialize'. (CVE-2014-3515)
  - An error exists related to configuration scripts and temporary file handling that could allow insecure file usage. (CVE-2014-3981)
  - A heap-based buffer overflow error exists related to the function 'dns_get_record' that could allow execution of arbitrary code. (CVE-2014-4049)
  - A type-confusion error exists related to the 'php_print_info' function which could allow disclosure of sensitive information. (CVE-2014-4721)
  - An error exists related to the unserialization and 'SplFileObject' handling that could allow denial of service attacks. (Bug 67072)
  - A double free error exists related to the 'Intl' extension and the method 'Locale::parseLocale' having an unspecified impact. (Bug 67349)
  - A buffer overflow error exists related to the 'Intl' extension and the functions 'locale_get_display_name' and 'uloc_getDisplayName' having unspecified impact. (Bug 67397)
  - An out-of-bounds read flaw affects the date_parse_from_format() function in 'ext/date/lib/parse_date.c' that is triggered as date parsing routines fail to check the end of strings. This may allow a remote attacker to crash an application linked against PHP or potentially disclose memory contents. (Bug 67251)
  - An out-of-bounds read flaw affects the timelib_meridian_with_check() function in 'ext/date/lib/parse_date.c' that is triggered as string ends are not properly checked. This may allow a remote attacker to crash an application linked against PHP or potentially disclose memory contents. (Bug 67253)

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.14. It is, therefore, affected by the following vulnerabilities :

  - Boundary checking errors exist related to the     Fileinfo extension, Composite Document Format (CDF)     handling and the functions 'cdf_read_short_sector',     'cdf_check_stream_offset', 'cdf_count_chain', and     'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479,     CVE-2014-3480, CVE-2014-3487)

  - A pascal string size handling error exists related to     the Fileinfo extension and the function 'mconvert'.
    (CVE-2014-3478)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - A type-confusion error exists related to the function     'php_print_info' that could allow disclosure of     sensitive information. (CVE-2014-4721)

  - An error exists related to unserialization and     'SplFileObject' handling that could allow denial of     service attacks. (Bug #67072)

  - A double free error exists related to the Intl     extension and the method 'Locale::parseLocale' having     unspecified impact. (Bug #67349)

  - A buffer overflow error exists related to the Intl     extension and the functions 'locale_get_display_name'     and 'uloc_getDisplayName' having unspecified impact.
    (Bug #67397)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.30. It is, therefore, affected by the following vulnerabilities :

  - Boundary checking errors exist related to the     Fileinfo extension, Composite Document Format (CDF)     handling and the functions 'cdf_read_short_sector',     'cdf_check_stream_offset', 'cdf_count_chain', and     'cdf_read_property_info'. (CVE-2014-0207, CVE-2014-3479,     CVE-2014-3480, CVE-2014-3487)

  - A pascal string size handling error exists related to     the Fileinfo extension and the function 'mconvert'.
    (CVE-2014-3478)

  - A type-confusion error exists related to the Standard     PHP Library (SPL) extension and the function     'unserialize'. (CVE-2014-3515)

  - An error exists related to configuration scripts and     temporary file handling that could allow insecure file     usage. (CVE-2014-3981)

  - A heap-based buffer overflow error exists related to the     function 'dns_get_record' that could allow execution of     arbitrary code. (CVE-2014-4049)

  - A type-confusion error exists related to the function     'php_print_info' that could allow disclosure of     sensitive information. (CVE-2014-4721)

  - An out-of-bounds read error exists in the     timelib_meridian_with_check() function due to a failure     to properly check string ends. A remote attacker can     exploit this to cause a denial of service condition or     to disclose memory contents.

  - An out-of-bounds read error exists in the     date_parse_from_format() function due to a failure     in the date parsing routines to properly check string     ends. A remote attacker can exploit this to cause a     denial of service condition or to disclose memory     contents.

  - An error exists related to unserialization and     'SplFileObject' handling that could allow denial of     service attacks. (Bug #67072)

  - A double free error exists related to the Intl     extension and the method 'Locale::parseLocale' having     unspecified impact. (Bug #67349)

  - A buffer overflow error exists related to the Intl     extension and the functions 'locale_get_display_name'     and 'uloc_getDisplayName' having unspecified impact.
    (Bug #67397)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
700510	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
82700	Mac OS X Multiple Vulnerabilities (Security Update 2015-004) (FREAK)	Nessus	MacOS X Local Security Checks	critical
82699	Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities (FREAK)	Nessus	MacOS X Local Security Checks	critical
78556	PHP 5.6.0 Multiple Vulnerabilities	Nessus	CGI abuses	high
78336	Amazon Linux AMI : php (ALAS-2014-393)	Nessus	Amazon Linux Local Security Checks	high
78315	Amazon Linux AMI : php55 (ALAS-2014-372)	Nessus	Amazon Linux Local Security Checks	high
78310	Amazon Linux AMI : php54 (ALAS-2014-367)	Nessus	Amazon Linux Local Security Checks	high
8394	Mac OS X < 10.9.5 Multiple Vulnerabilities (Security Update 2014-004)	Nessus Network Monitor	Web Clients	critical
77748	Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
77455	GLSA-201408-11 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
77285	PHP 5.3.x < 5.3.29 Multiple Vulnerabilities	Nessus	CGI abuses	high
77241	FreeBSD : PHP multiple vulnerabilities (d2a892b9-2605-11e4-9da0-00a0986f28c4)	Nessus	FreeBSD Local Security Checks	high
76476	Slackware 14.0 / 14.1 / current : php (SSA:2014-192-01)	Nessus	Slackware Local Security Checks	high
8320	PHP 5.4.x < 5.4.30 / 5.5.x < 5.5.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
76282	PHP 5.5.x < 5.5.14 Multiple Vulnerabilities	Nessus	CGI abuses	high
76281	PHP 5.4.x < 5.4.30 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2014-3981

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

high

high

high

high

critical

high

high