The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code and cause a denial of service (out-of-bounds read) via regular expression with a group containing both a forward referencing subroutine call and a recursive back reference, as demonstrated by "((?+1)(\1))/".

The version of MariaDB installed on the remote host is prior to 10.0.18. It is, therefore, affected by multiple vulnerabilities as referenced in the mariadb-10-0-18-release-notes advisory.

  - Heap-based buffer overflow in PCRE 8.36 and earlier allows remote attackers to cause a denial of service     (crash) or have other unspecified impact via a crafted regular expression, related to an assertion that     allows zero repeats. (CVE-2014-8964)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote     authenticated users to affect availability via unknown vectors related to Server : Federated.
    (CVE-2015-0499)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote     authenticated users to affect availability via unknown vectors related to Server : Compiling.
    (CVE-2015-0501)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote     authenticated users to affect availability via vectors related to DDL. (CVE-2015-0505)

  - The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect     code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified     impact via a regular expression with a group containing a forward reference repeated a large number of     times within a repeated outer group that has a zero minimum quantifier. (CVE-2015-2325)

  - The pcre_compile2 function in PCRE before 8.37 allows context-dependent attackers to compile incorrect     code and cause a denial of service (out-of-bounds read) via regular expression with a group containing     both a forward referencing subroutine call and a recursive back reference, as demonstrated by     ((?+1)(\1))/. (CVE-2015-2326)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote     authenticated users to affect availability via unknown vectors related to Server : Optimizer.
    (CVE-2015-2571)

  - Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and 5.6.23 and earlier allows remote     authenticated users to affect availability via unknown vectors related to Server : Optimizer.
    (CVE-2015-4757)

  - Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to     affect availability via unknown vectors related to Server : InnoDB. (CVE-2015-4866)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.10. It is, therefore, affected by multiple vulnerabilities :

 - Multiple heap buffer overflow conditions exist in the bundled Perl-Compatible Regular Expression (PCRE) library due to improper validation of user-supplied input to the compile_branch() and pcre_compile2() functions. A remote attacker can exploit these conditions to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326)

 - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of quotes in collation sequence names. A remote attacker can exploit this to cause uninitialized memory access, resulting in denial of service condition. (CVE-2015-3414)

 - A denial of service vulnerability exists in the bundled SQLite component due to an improper implementation of comparison operators in the sqlite3VdbeExec() function in vdbe.c. A remote attacker can exploit this to cause an invalid free operation, resulting in a denial of service condition. (CVE-2015-3415)

 - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of precision and width values during floating-point conversions in the sqlite3VXPrintf() function in printf.c. A remote attacker can exploit this to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-3416)

 - A security bypass vulnerability exists due to a failure in multiple extensions to check for NULL bytes in a path when processing or reading a file. A remote attacker can exploit this, by combining the '\\0' character with a safe file extension, to bypass access restrictions. (CVE-2015-4598)

 - An arbitrary command injection vulnerability exists due to a flaw in the php_escape_shell_arg() function in exec.c. A remote attacker can exploit this, via the escapeshellarg() PHP method, to inject arbitrary operating system commands. (CVE-2015-4642)

 - A heap buffer overflow condition exists in the ftp_genlist() function in ftp.c. due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4643) - A denial of service vulnerability exists due to a NULL pointer dereference flaw in the build_tablename() function in pgsql.c. An authenticated, remote attacker can exploit this to cause an application crash. (CVE-2015-4644)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote pfSense install is prior to 2.2.3. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2943-1 advisory.

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SecurityCenter application installed on the remote host is affected by multiple vulnerabilities in the bundled version of PHP that is prior to version 5.4.41. It is, therefore, affected by the following vulnerabilities :

 - A flaw in the phar_parse_tarfile function in     ext/phar/tar.c could allow a denial of service     via a crafted entry in a tar archive.
    (CVE-2015-4021)

  - An integer overflow condition exists in the     ftp_genlist() function in ftp.c due to improper     validation of user-supplied input. A remote attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or possible     remote code execution. (CVE-2015-4022)

  - Multiple flaws exist related to using pathnames     containing NULL bytes. A remote attacker can exploit     these flaws, by combining the '\0' character with a safe     file extension, to bypass access restrictions. This had     been previously fixed but was reintroduced by a     regression in versions 5.4+. (CVE-2006-7243,     CVE-2015-4025)

  - Multiple heap buffer overflow conditions exist in the     bundled Perl-Compatible Regular Expression (PCRE)     library due to improper validation of user-supplied     input to the compile_branch() and pcre_compile2()     functions. A remote attacker can exploit these     conditions to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2015-2325,     CVE-2015-2326)

  - A security bypass vulnerability exists due to a flaw in     the pcntl_exec implementation that truncates a pathname     upon encountering the '\x00' character. A remote     attacker can exploit this, via a crafted first argument,     to bypass intended extension restrictions and execute     arbitrary files. (CVE-2015-4026)

  - A flaw exists in the multipart_buffer_headers() function     in rfc1867.c due to improper handling of     multipart/form-data in HTTP requests. A remote attacker     can exploit this flaw to cause a consumption of CPU     resources, resulting in a denial of service condition.
    (CVE-2015-4024)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2694-1 advisory.

    Michele Spagnuolo discovered that PCRE incorrectly handled certain regular expressions. A remote attacker     could use this issue to cause applications using PCRE to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-8964)

    Kai Lu discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2325,     CVE-2015-2326)

    Wen Guanxing discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could     use this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 15.04. (CVE-2015-3210)

    It was discovered that PCRE incorrectly handled certain regular expressions. A remote attacker could use     this issue to cause applications using PCRE to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and 14.04 LTS. (CVE-2015-5073)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - Logjam attack: mysql uses 512 bit dh groups in SSL     [bnc#934789]

  - CVE-2015-3152: mysql --ssl does not enforce SSL     [bnc#924663]

  - CVE-2014-8964: heap buffer overflow [bnc#906574]

  - CVE-2015-2325: heap buffer overflow in compile_branch()     [bnc#924960]

  - CVE-2015-2326: heap buffer overflow in pcre_compile2()     [bnc#924961]

  - CVE-2015-0501: unspecified vulnerability related to     Server:Compiling (CPU April 2015)

  - CVE-2015-2571: unspecified vulnerability related to     Server:Optimizer (CPU April 2015)

  - CVE-2015-0505: unspecified vulnerability related to     Server:DDL (CPU April 2015)

  - CVE-2015-0499: unspecified vulnerability related to     Server:Federated (CPU April 2015)

  - CVE-2015-2568: unspecified vulnerability related to     Server:Security:Privileges (CPU April 2015)

  - CVE-2015-2573: unspecified vulnerability related to     Server:DDL (CPU April 2015)

  - CVE-2015-0433: unspecified vulnerability related to     Server:InnoDB:DML (CPU April 2015)

  - CVE-2015-0441: unspecified vulnerability related to     Server:Security:Encryption (CPU April 2015)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

MariaDB was updated to its current minor version, fixing bugs and security issues.

These updates include a fix for Logjam (CVE-2015-4000), making MariaDB work with client software that no longer allows short DH groups over SSL, as e.g. our current openssl packages.

On openSUSE 13.1, MariaDB was updated to 5.5.44.

On openSUSE 13.2, MariaDB was updated from 10.0.13 to 10.0.20.

Please read the release notes of MariaDB https://mariadb.com/kb/en/mariadb/mariadb-10020-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10019-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10018-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10017-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10016-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10015-release-notes/ https://mariadb.com/kb/en/mariadb/mariadb-10014-release-notes/ for more information.

Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.6 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.5 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.10. It is, therefore, affected by multiple vulnerabilities :

  - Multiple heap buffer overflow conditions exist in the     bundled Perl-Compatible Regular Expression (PCRE)     library due to improper validation of user-supplied     input to the compile_branch() and pcre_compile2()     functions. A remote attacker can exploit these     conditions to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2015-2325,     CVE-2015-2326)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of quotes     in collation sequence names. A remote attacker can     exploit this to cause uninitialized memory access,     resulting in denial of service condition.
    (CVE-2015-3414)

  - A denial of service vulnerability exists in the bundled     SQLite component due to an improper implementation of     comparison operators in the sqlite3VdbeExec() function     in vdbe.c. A remote attacker can exploit this to cause     an invalid free operation, resulting in a denial of     service condition. (CVE-2015-3415)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of precision     and width values during floating-point conversions in     the sqlite3VXPrintf() function in printf.c. A remote     attacker can exploit this to cause a stack-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-3416)

  - A security bypass vulnerability exists due to a failure     in multiple extensions to check for NULL bytes in a path     when processing or reading a file. A remote attacker can     exploit this, by combining the '\0' character with a     safe file extension, to bypass access restrictions.
    (CVE-2015-4598)

  - An arbitrary command injection vulnerability exists due     to a flaw in the php_escape_shell_arg() function in     exec.c. A remote attacker can exploit this, via the     escapeshellarg() PHP method, to inject arbitrary     operating system commands. (CVE-2015-4642)

  - A heap buffer overflow condition exists in the     ftp_genlist() function in ftp.c. due to improper     validation of user-supplied input. A remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2015-4643)     
  - A denial of service vulnerability exists due to a NULL     pointer dereference flaw in the build_tablename()     function in pgsql.c. An authenticated, remote attacker     can exploit this to cause an application crash.
    (CVE-2015-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.26. It is, therefore, affected by multiple vulnerabilities :    

  - Multiple heap buffer overflow conditions exist in the     bundled Perl-Compatible Regular Expression (PCRE)     library due to improper validation of user-supplied     input to the compile_branch() and pcre_compile2()     functions. A remote attacker can exploit these     conditions to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2015-2325,     CVE-2015-2326)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of quotes     in collation sequence names. A remote attacker can     exploit this to cause uninitialized memory access,     resulting in denial of service condition.
    (CVE-2015-3414)

  - A denial of service vulnerability exists in the bundled     SQLite component due to an improper implementation of     comparison operators in the sqlite3VdbeExec() function     in vdbe.c. A remote attacker can exploit this to cause     an invalid free operation, resulting in a denial of     service condition. (CVE-2015-3415)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of precision     and width values during floating-point conversions in     the sqlite3VXPrintf() function in printf.c. A remote     attacker can exploit this to cause a stack-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-3416)

  - A security bypass vulnerability exists due to a failure     in multiple extensions to check for NULL bytes in a path     when processing or reading a file. A remote attacker can     exploit this, by combining the '\0' character with a     safe file extension, to bypass access restrictions.
    (CVE-2015-4598)

  - An arbitrary command injection vulnerability exists due     to a flaw in the php_escape_shell_arg() function in     exec.c. A remote attacker can exploit this, via the     escapeshellarg() PHP method, to inject arbitrary     operating system commands. (CVE-2015-4642)

  - A heap buffer overflow condition exists in the     ftp_genlist() function in ftp.c. due to improper     validation of user-supplied input. A remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2015-4643)     
  - A denial of service vulnerability exists due to a NULL     pointer dereference flaw in the build_tablename()     function in pgsql.c. An authenticated, remote attacker     can exploit this to cause an application crash.
    (CVE-2015-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.42. It is, therefore, affected by multiple vulnerabilities :

  - Multiple heap buffer overflow conditions exist in the     bundled Perl-Compatible Regular Expression (PCRE)     library due to improper validation of user-supplied     input to the compile_branch() and pcre_compile2()     functions. A remote attacker can exploit these     conditions to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code. (CVE-2015-2325,     CVE-2015-2326)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of quotes     in collation sequence names. A remote attacker can     exploit this to cause uninitialized memory access,     resulting in denial of service condition.
    (CVE-2015-3414)

  - A denial of service vulnerability exists in the bundled     SQLite component due to an improper implementation of     comparison operators in the sqlite3VdbeExec() function     in vdbe.c. A remote attacker can exploit this to cause     an invalid free operation, resulting in a denial of     service condition. (CVE-2015-3415)

  - A denial of service vulnerability exists in the bundled     SQLite component due to improper handling of precision     and width values during floating-point conversions in     the sqlite3VXPrintf() function in printf.c. A remote     attacker can exploit this to cause a stack-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code. (CVE-2015-3416)

  - A security bypass vulnerability exists due to a failure     in multiple extensions to check for NULL bytes in a path     when processing or reading a file. A remote attacker can     exploit this, by combining the '\0' character with a     safe file extension, to bypass access restrictions.
    (CVE-2015-4598)

  - An arbitrary command injection vulnerability exists due     to a flaw in the php_escape_shell_arg() function in     exec.c. A remote attacker can exploit this, via the     escapeshellarg() PHP method, to inject arbitrary     operating system commands. (CVE-2015-4642)

  - A heap buffer overflow condition exists in the     ftp_genlist() function in ftp.c. due to improper     validation of user-supplied input. A remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2015-4643)     
  - A denial of service vulnerability exists due to a NULL     pointer dereference flaw in the build_tablename()     function in pgsql.c. An authenticated, remote attacker     can exploit this to cause an application crash.
    (CVE-2015-4644)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 5.5.x prior to 5.5.26, or 5.6.x prior to 5.6.10 are exposed to the following vulnerabilities :

 - Multiple heap buffer overflow conditions exist in the bundled Perl-Compatible Regular Expression (PCRE) library due to improper validation of user-supplied input to the 'compile_branch()' and 'pcre_compile2()' functions. A remote attacker can exploit these conditions to cause a heap-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326)
 - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of quotes in collation sequence names. A remote attacker can exploit this to cause uninitialized memory access, resulting in denial of service condition. (CVE-2015-3414)
 - A denial of service vulnerability exists in the bundled SQLite component due to an improper implementation of comparison operators in the 'sqlite3VdbeExec()' function in 'vdbe.c'. A remote attacker can exploit this to cause an invalid free operation, resulting in a denial of service condition. (CVE-2015-3415)
 - A denial of service vulnerability exists in the bundled SQLite component due to improper handling of precision and width values during floating-point conversions in the 'sqlite3VXPrintf()' function in 'printf.c'. A remote attacker can exploit this to cause a stack-based buffer overflow, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-3416)
 - A security bypass vulnerability exists due to a failure in multiple extensions to check for NULL bytes in a path when processing or reading a file. A remote attacker can exploit this, by combining the '\0' character with a safe file extension, to bypass access restrictions. (CVE-2015-4598)
 - An arbitrary command injection vulnerability exists due to a flaw in the 'php_escape_shell_arg()' function in 'exec.c'. A remote attacker can exploit this, via the 'escapeshellarg()' PHP method, to inject arbitrary operating system commands. (CVE-2015-4642)
 - A heap buffer overflow condition exists in the 'ftp_genlist()' function in 'ftp.c'. due to improper validation of user-supplied input. A remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4643)
 - A denial of service vulnerability exists due to a NULL pointer dereference flaw in the 'build_tablename()' function in 'pgsql.c'. An authenticated, remote attacker can exploit this to cause an application crash. (CVE-2015-4644)

Versions of PHP 5.6.x earlier than 5.6.9 are exposed to the following issues :

  - Multiple flaws exist related to using pathnames containing NULL bytes. A remote attacker can exploit these flaws, by combining the '\0' character with a safe file extension, to bypass access restrictions. This had been previously fixed but was reintroduced by a regression in versions 5.4+. (CVE-2006-7243, CVE-2015-4025)

  - A flaw exists in the phar_parse_tarfile() function in 'ext/phar/tar.c' that is triggered when handling zero-length filenames. This may allow an attacker to corrupt memory, crashing an application or potentially allowing code execution. (CVE-2015-4021)

  - An integer overflow condition exists in the ftp_genlist() function in 'ftp.c' due to improper validation of user-supplied input. A remote attacker can exploit this to cause a heap-based buffer overflow, resulting in a denial of service condition or possible remote code execution. (CVE-2015-4022)

  - A flaw exists in the multipart_buffer_headers() function in 'rfc1867.c' due to improper handling of multipart/form-data in HTTP requests. A remote attacker can exploit this flaw to cause a consumption of CPU resources, resulting in a denial of service condition. (CVE-2015-4024)

  - A security bypass vulnerability exists due to a flaw in the 'pcntl_exec' implementation that truncates a pathname upon encountering the '\x00' character. A remote attacker can exploit this, via a crafted first argument, to bypass intended extension restrictions and execute arbitrary files. (CVE-2015-4026)

  - The PCRE library contains an overflow condition in the functions 'pcre_compile2()' and 'compile_branch()'. These issues are triggered as user-supplied input is not properly validated when handling regex. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2015-2325, CVE-2015-2326)

  - An integer overflow condition exists in the function str_repeat(). The issue is triggered due to a sign mismatch condition. This may allow a context-dependent attacker to create corrupted ZVALs, leading to memory corruption. This may result in a denial of service or potentially the execution of arbitrary code.

  - An overflow condition affects the unpack() function in 'ext/standard/pack.c'. The issue is triggered as user-supplied input passed via the 'format' parameter is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.

  - An unspecified flaw exists in the zend_std_get_method() function in 'Zend/zend_compile.c' that may allow an attacker to trigger an invalid read. No further details have been provided by the vendor.

An integer underflow flaw leading to out-of-bounds memory access was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. (CVE-2015-4021)

An integer overflow flaw leading to a heap based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4025)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026)

PCRE library is prone to a heap overflow vulnerability. Due to insufficient bounds checking inside compile_branch(), the heap memory could be overflowed via a crafted regular expression. Since PCRE library is widely used, this vulnerability should affect many applications using it. An attacker may exploit this issue to execute arbitrary code in the context of the user running the affected application. (CVE-2015-2325)

PCRE library is prone to a vulnerability which leads to Heap overflow.
Without enough bound checking inside pcre_compile2(), the heap memory could be overflowed via a crafted regular expression. Since PCRE library is widely used, this vulnerability should affect many applications. An attacker may exploit this issue to execute arbitrary code in the context of the user running the affected application.
(CVE-2015-2326)

PCRE development team reports :

A pattern such as '((?2){0,1999}())?', which has a group containing a forward reference repeated a large (but limited) number of times within a repeated outer group that has a zero minimum quantifier, caused incorrect code to be compiled, leading to the error 'internal error: previously-checked referenced subpattern not found' when an incorrect memory address was read. This bug was reported as 'heap overflow', discovered by Kai Lu of Fortinet's FortiGuard Labs and given the CVE number CVE-2015-2325.

A pattern such as '((?+1)(\1))/' containing a forward reference subroutine call within a group that also contained a recursive back reference caused incorrect code to be compiled. This bug was reported as 'heap overflow', discovered by Kai Lu of Fortinet's FortiGuard Labs, and given the CVE number CVE-2015-2326.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.9. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws in pcrelib.
    (CVE-2015-2325, CVE-2015-2326)

  - A flaw in the phar_parse_tarfile function in     ext/phar/tar.c could allow a denial of service     via a crafted entry in a tar archive.
    (CVE-2015-4021)

  - Multiple flaws exist related to using pathnames     containing NULL bytes. A remote attacker can exploit     these flaws, by combining the '\0' character with a safe     file extension, to bypass access restrictions. This had     been previously fixed but was reintroduced by a     regression in versions 5.4+. (CVE-2006-7243,     CVE-2015-4025)

  - An integer overflow condition exists in the     ftp_genlist() function in ftp.c due to improper     validation of user-supplied input. A remote attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or possible     remote code execution. (CVE-2015-4022)

  - A flaw exists in the multipart_buffer_headers() function     in rfc1867.c due to improper handling of     multipart/form-data in HTTP requests. A remote attacker     can exploit this flaw to cause a consumption of CPU     resources, resulting in a denial of service condition.
    (CVE-2015-4024)

  - A security bypass vulnerability exists due to a flaw in     the pcntl_exec implementation that truncates a pathname     upon encountering the '\x00' character. A remote     attacker can exploit this, via a crafted first argument,     to bypass intended extension restrictions and execute     arbitrary files. (CVE-2015-4026)

  - A NULL pointer dereference flaw exists in the     xsl_ext_function_php() function in xsltprocessor.c due     to improper validation of user-supplied input. A remote     attacker can exploit this to cause a denial of service     condition.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.41. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified flaws in pcrelib.
    (CVE-2015-2325, CVE-2015-2326)

  - A flaw in the phar_parse_tarfile function in     ext/phar/tar.c could allow a denial of service     via a crafted entry in a tar archive.
    (CVE-2015-4021)

  - An integer overflow condition exists in the     ftp_genlist() function in ftp.c due to improper     validation of user-supplied input. A remote attacker can     exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or possible     remote code execution. (CVE-2015-4022)

  - Multiple flaws exist related to using pathnames     containing NULL bytes. A remote attacker can exploit     these flaws, by combining the '\0' character with a safe     file extension, to bypass access restrictions. This had     been previously fixed but was reintroduced by a     regression in versions 5.4+. (CVE-2006-7243,     CVE-2015-4025)

  - A flaw exists in the multipart_buffer_headers() function     in rfc1867.c due to improper handling of     multipart/form-data in HTTP requests. A remote attacker     can exploit this flaw to cause a consumption of CPU     resources, resulting in a denial of service condition.
    (CVE-2015-4024)

  - A security bypass vulnerability exists due to a flaw in     the pcntl_exec implementation that truncates a pathname     upon encountering the '\x00' character. A remote     attacker can exploit this, via a crafted first argument,     to bypass intended extension restrictions and execute     arbitrary files. (CVE-2015-4026)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The regular expression library pcre was updated to 8.37 to fix three security issues and a number of bugs and correctness issues.

The following vulnerabilities were fixed :

  - CVE-2015-2325: Specially crafted regular expressions     could have caused a heap buffer overlow in     compile_branch(), potentially allowing the execution of     arbitrary code. (boo#924960)

  - CVE-2015-2326: Specially crafted regular expressions     could have caused a heap buffer overlow in     pcre_compile2(), potentially allowing the execution of     arbitrary code. [boo#924961]

  - CVE-2014-8964: Specially crafted regular expression     could have caused a denial of service (crash) or have     other unspecified impact. [boo#906574]

ID	Name	Product	Family	Severity
167888	MariaDB 10.0.0 < 10.0.18 Multiple Vulnerabilities	Nessus	Databases	high
98802	PHP 5.6.x < 5.6.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
106495	pfSense < 2.2.3 Multiple Vulnerabilities (SA-15_07) (Logjam)	Nessus	Firewalls	critical
90306	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2943-1)	Nessus	Ubuntu Local Security Checks	critical
85566	Tenable SecurityCenter Multiple PHP Vulnerabilities (TNS-2015-06)	Nessus	Misc.	critical
85122	Ubuntu 14.04 LTS : PCRE vulnerabilities (USN-2694-1)	Nessus	Ubuntu Local Security Checks	critical
84913	SUSE SLED12 / SLES12 Security Update : mariadb (SUSE-SU-2015:1273-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	high
84830	Slackware 14.0 / 14.1 / current : php (SSA:2015-198-02) (BACKRONYM)	Nessus	Slackware Local Security Checks	critical
84658	openSUSE Security Update : MariaDB (openSUSE-2015-479) (BACKRONYM) (Logjam)	Nessus	SuSE Local Security Checks	high
84625	Amazon Linux AMI : php56 (ALAS-2015-563)	Nessus	Amazon Linux Local Security Checks	critical
84624	Amazon Linux AMI : php55 (ALAS-2015-562)	Nessus	Amazon Linux Local Security Checks	critical
84364	PHP 5.6.x < 5.6.10 Multiple Vulnerabilities	Nessus	CGI abuses	critical
84363	PHP 5.5.x < 5.5.26 Multiple Vulnerabilities	Nessus	CGI abuses	critical
84362	PHP 5.4.x < 5.4.42 Multiple Vulnerabilities	Nessus	CGI abuses	critical
8787	PHP 5.5.x < 5.5.26 / 5.6.x < 5.6.10 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	medium
8786	PHP 5.6.x < 5.6.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
84127	Slackware 14.0 / 14.1 / current : php (SSA:2015-162-02)	Nessus	Slackware Local Security Checks	high
83975	Amazon Linux AMI : php56 (ALAS-2015-536)	Nessus	Amazon Linux Local Security Checks	high
83973	Amazon Linux AMI : php54 (ALAS-2015-534)	Nessus	Amazon Linux Local Security Checks	high
83795	FreeBSD : pcre -- multiple vulnerabilities (4a88e3ed-00d3-11e5-a072-d050996490d0)	Nessus	FreeBSD Local Security Checks	high
83519	PHP 5.6.x < 5.6.9 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83517	PHP 5.4.x < 5.4.41 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83392	openSUSE Security Update : pcre (openSUSE-2015-353)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-2326

medium

Tenable Plugins

high

critical

critical

critical

critical

critical

high

critical

high

critical

critical

critical

critical

critical

medium

high

high

high

high

high

critical

critical

high