The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter."

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory.

  - php: use after free vulnerability in unserialize() (CVE-2014-8142)

  - php: out of bounds read when parsing a crafted .php file (CVE-2014-9427)

  - file: out of bounds read in mconvert() (CVE-2014-9652)

  - php: heap buffer overflow in enchant_broker_request_dict() (CVE-2014-9705)

  - gd: buffer read overflow in gd_gif_in.c (CVE-2014-9709)

  - php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142) (CVE-2015-0231)

  - php: Free called on unitialized pointer in exif.c (CVE-2015-0232)

  - php: use after free vulnerability in unserialize() with DateTimeZone (CVE-2015-0273)

  - php: use after free in opcache extension (CVE-2015-1351)

  - php: use after free in phar_object.c (CVE-2015-2301)

  - regex: heap overflow in regcomp() on 32-bit architectures (CVE-2015-2305)

  - php: move_uploaded_file() NUL byte injection in file name (CVE-2015-2348)

  - php: buffer over-read in Phar metadata parsing (CVE-2015-2783)

  - php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re     (CVE-2015-2787)

  - php: invalid pointer free() in phar_tar_process_metadata() (CVE-2015-3307)

  - php: buffer overflow in phar_set_inode() (CVE-2015-3329)

  - php: pipelined request executed in deinitialized interpreter under httpd 2.4 (CVE-2015-3330)

  - php: missing null byte checks for paths in various PHP extensions (CVE-2015-3411, CVE-2015-3412)

  - php: SoapClient's __call() type confusion through unserialize() (CVE-2015-4147)

  - php: SoapClient's do_soap_call() type confusion after unserialize() (CVE-2015-4148)

  - php: type confusion issue in unserialize() with various SOAP methods (CVE-2015-4599, CVE-2015-4600,     CVE-2015-4601)

  - php: Incomplete Class unserialization type confusion (CVE-2015-4602)

  - php: exception::getTraceAsString type confusion issue after unserialize (CVE-2015-4603)

  - php: denial of service when processing a crafted file with Fileinfo (CVE-2015-4604, CVE-2015-4605)

  - php: HTTP response splitting in header() function (CVE-2015-8935)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1186 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - pgsql: fix NULL pointer dereference CVE-2015-1352

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory.

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within     the serialized properties of an object, a different vulnerability than CVE-2004-1019. (CVE-2014-8142)

  - The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before     5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause     a denial of service (out-of-bounds memory access and application crash) via a crafted file.
    (CVE-2014-9652)

  - Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary     code via vectors that trigger creation of multiple dictionaries. (CVE-2014-9705)

  - The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x     before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application     crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
    (CVE-2014-9709)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys     within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete     fix for CVE-2014-8142. (CVE-2015-0231)

  - The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x     before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized     pointer free and application crash) via crafted EXIF data in a JPEG image. (CVE-2015-0232)

  - Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22,     and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input     containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the     php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the     php_date_initialize_from_hash function. (CVE-2015-0273)

  - Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and     5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other     impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.
    (CVE-2015-2301)

  - The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows     remote attackers to bypass intended extension restrictions and create files with unexpected names via a     crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
    (CVE-2015-2348)

  - ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to obtain sensitive information from process memory or cause a denial of service (buffer over-read and     application crash) via a crafted length value in conjunction with crafted serialized data in a phar     archive, related to the phar_parse_metadata and phar_parse_pharfile functions. (CVE-2015-2783)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup     function, a related issue to CVE-2015-0231. (CVE-2015-2787)

  - The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly     have unspecified other impact via a crafted tar archive. (CVE-2015-3307)

  - Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before     5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a     crafted length value in a (1) tar, (2) phar, or (3) ZIP archive. (CVE-2015-3329)

  - The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24,     and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a     denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that     result in a deconfigured interpreter. (CVE-2015-3330)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an     application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the     finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that     bypasses an intended configuration in which client users may read only .xml files. (CVE-2015-3411)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read arbitrary files via crafted input to an application     that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a     filename\0.extension attack that bypasses an intended configuration in which client users may read files     with only one specific extension. (CVE-2015-3412)

  - The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x     before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute     arbitrary code by providing crafted serialized data with an unexpected data type, related to a type     confusion issue. (CVE-2015-4147)

  - The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before     5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive     information by providing crafted serialized data with an int data type, related to a type confusion     issue. (CVE-2015-4148)

  - The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service     (application crash), or possibly execute arbitrary code via an unexpected data type, related to a type     confusion issue. (CVE-2015-4599)

  - The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows     remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via     an unexpected data type, related to type confusion issues in the (1) SoapClient::__getLastRequest, (2)     SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4)     SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie     methods. (CVE-2015-4600)

  - PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via an unexpected data type, related to type confusion issues in (1)     ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than     CVE-2015-4600. (CVE-2015-4601)

  - The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via an unexpected data type, related to a type confusion issue.
    (CVE-2015-4602)

  - The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data     type, related to a type confusion issue. (CVE-2015-4603)

  - The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship,     which allows remote attackers to cause a denial of service (application crash) or possibly execute     arbitrary code via a crafted string that is mishandled by a Python script text executable rule.
    (CVE-2015-4604)

  - The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which     allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary     code via a crafted string that is mishandled by a Python script text executable rule. (CVE-2015-4605)

  - sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through     5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during     processing of an invalid file that begins with a # character and lacks a newline character, which causes     an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi     process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if     a valid PHP script is present in memory locations adjacent to the mapping. (CVE-2014-9427)

  - Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache     extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have     unspecified other impact via unknown vectors. (CVE-2015-1351)

  - Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer)     alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-     dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based     buffer overflow. (CVE-2015-2305)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4147)

  - An invalid free flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3307)

  - A flaw was found in the way the PHP module for the     Apache httpd web server handled pipelined requests. A     remote attacker could use this flaw to trigger the     execution of a PHP script in a deinitialized     interpreter, causing it to crash or, possibly, execute     arbitrary code.(CVE-2015-3330)

  - Multiple flaws were discovered in the way PHP's Soap     extension performed object unserialization. Specially     crafted input processed by the unserialize() function     could cause a PHP application to disclose portion of     its memory or crash.(CVE-2015-4600)

  - Zend/zend_exceptions.c in PHP, possibly 5.x before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (infinite loop) via a     crafted Exception object in serialized data, a related     issue to CVE-2015-8876.(CVE-2016-7478)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-3411)

  - The asn1_time_to_time_t function in     ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x     before 5.4.23, and 5.5.x before 5.5.7 does not properly     parse (1) notBefore and (2) notAfter timestamps in     X.509 certificates, which allows remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted certificate that is     not properly handled by the openssl_x509_parse     function.(CVE-2013-6420)

  - A use-after-free flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2301)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9024)

  - An issue was discovered in PHP before 7.1.27, 7.2.x     before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is     possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing,     thus enabling unauthorized users to access the     data.(CVE-2019-9637)

  - An issue was discovered in the EXIF component in PHP     before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an Invalid Read in     exif_process_SOFn.(CVE-2019-9640)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

 - An unspecified use-after-free error exists in the _zend_shared_memdup() function within file ext/opcache/zend_shared_alloc.c that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2015-1351)

 - A NULL pointer dereference flaw exists in the build_tablename() function within file pgsql.c in the PostgreSQL extension due to a failure to validate token extraction for table names. An authenticated, remote attacker can exploit this, via a crafted name, to cause a denial of service condition. (CVE-2015-1352)

 - An out-of-bounds read error exists in the Phar component due to improper validation of user-supplied input when handling phar parsing during unserialize() function calls. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. (CVE-2015-2783)

 - A memory corruption issue exists in the phar_parse_metadata() function in file ext/phar/phar.c due to improper validation of user-supplied input when parsing a specially crafted TAR archive. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3307)

 - Multiple stack-based buffer overflow conditions exist in the phar_set_inode() function in file phar_internal.h when handling archive files, such as tar, zip, or phar files. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or the execution or arbitrary code. (CVE-2015-3329)

 - A flaw exists in the Apache2handler SAPI component when handling pipelined HTTP requests that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3330)

 - A flaw exists in multiple functions due to a failure to check for NULL byte (%00) sequences in a path when processing or reading a file. An unauthenticated, remote attacker can exploit this, via specially crafted input to an application calling those functions, to bypass intended restrictions and disclose potentially sensitive information. (CVE-2015-3411, CVE-2015-3412)

 - A type confusion error exists in multiple functions within file ext/soap/soap.c that is triggered when calling unserialize(). An unauthenticated, remote attacker can exploit this to disclose memory contents, cause a denial of service condition, or execute arbitrary code. (CVE-2015-4599, CVE-2015-4600)

 - Multiple type confusion errors exist within files ext/soap/php_encoding.c, ext/soap/php_http.c, and ext/soap/soap.c that allow an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4601)

 - A type confusion error exists in the __PHP_Incomplete_Class() function within file ext/standard/incomplete_class.c that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4602)

 - A type confusion error exists in the exception::getTraceAsString() function within file Zend/zend_exceptions.c that allows a remote attacker to execute arbitrary code. (CVE-2015-4603)

 - A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mget() function within file softmagic.c. The function fails to maintain a certain pointer relationship. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4604)

 - A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mcopy() function within file softmagic.c. The function fails to properly handle an offset that exceeds 'bytecnt'. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4605)

 - A use-after-free error exists in the sqlite3_close() function within file /ext/sqlite3/sqlite3.c when closing database connections. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - A flaw exists in the ZEND_VM_HELPER_EX() function within file /Zend/zend_vm_def.h when handling a __get() function call. An unauthenticated, remote attacker can exploit this to cause a cause a denial of service condition.

 - A type confusion error exists in the php_stream_url_wrap_http_ex() function within file ext/standard/http_fopen_wrapper.c that allows an unauthenticated, remote attacker to execute arbitrary code.

 - A use-after-free error exists in the php_curl() function within file ext/curl/interface.c that allows an unauthenticated, remote attacker to execute arbitrary code.

 - A use-after-free error exists in the SPL component, specifically in the spl_object_storage_get_gc() function within file ext/spl/spl_observer.c. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - A NULL pointer dereference flaw exists within file /ext/ereg/regex/regcomp.c that allows an unauthenticated, remote attacker attacker to cause a denial of service condition.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

PHP was updated to fix ten security issues.

The following vulnerabilities were fixed :

  - CVE-2014-9709: A specially crafted GIF file could cause     a buffer read overflow in php-gd (bnc#923946)

  - CVE-2015-2301: Memory was use after it was freed in PHAR     (bnc#922022)

  - CVE-2015-2305: heap overflow vulnerability in regcomp.c     (bnc#922452)

  - CVE-2014-9705: heap buffer overflow in Enchant     (bnc#922451)

  - CVE-2015-2787: use-after-free vulnerability in the     process_nested_data function (bnc#924972)

  - unserialize SoapClient type confusion (bnc#925109)

  - CVE-2015-2348: move_uploaded_file truncates a pathNAME     upon encountering a x00 character (bnc#924970)

  - CVE-2015-3330: Specially crafted PHAR files could, when     executed under Apache httpd 2.4 (apache2handler), allow     arbitrary code execution (bnc#928506)

  - CVE-2015-3329: Specially crafted PHAR data could lead to     disclosure of sensitive information due to a buffer     overflow (bnc#928506)

  - CVE-2015-2783: Specially crafted PHAR data could lead to     disclosure of sensitive information due to a buffer     over-read (bnc#928511)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11 and is affected by multiple vulnerabilities in the following components : 

 - Address Book 
 - AirScan 
 - apache_mod_php 
 - Apple Online Store Kit 
 - AppleEvents 
 - Audio 
 - bash 
 - Certificate Trust Policy 
 - CFNetwork Cookies - CFNetwork FTPProtocol 
 - CFNetwork HTTPProtocol 
 - CFNetwork Proxies 
 - CFNetwork SSL 
 - CoreCrypto 
 - CoreText 
 - Dev Tools 
 - Disk Images 
 - dyld 
 - EFI 
 - Finder 
 - Game Center 
 - Heimdal 
 - ICU 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAudioFamily 
 - IOGraphics 
 - IOHIDFamily 
 - IOStorageFamily 
 - Kernel 
 - libc 
 - libpthread 
 - libxpc 
 - Login Window 
 - lukemftpd 
 - Mail 
 - Multipeer Connectivity 
 - NetworkExtension 
 - Notes 
 - OpenSSH 
 - OpenSSL 
 - procmail 
 - remote_cmds 
 - removefile 
 - Ruby 
 - Safari 
 - Safari Downloads 
 - Safari Extensions 
 - Safari Safe Browsing 
 - Security 
 - SMB 
 - SQLite 
 - Telephony 
 - Terminal 
 - tidy 
 - Time Machine 
 - WebKit 
 - WebKit CSS 
 - WebKit JavaScript Bindings 
 - WebKit Page Loading 
 - WebKit Plug-ins

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is 10.6.8 or later but prior to 10.11. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Address Book
  - AirScan
  - apache_mod_php
  - Apple Online Store Kit
  - AppleEvents
  - Audio
  - bash
  - Certificate Trust Policy
  - CFNetwork Cookies
  - CFNetwork FTPProtocol
  - CFNetwork HTTPProtocol
  - CFNetwork Proxies
  - CFNetwork SSL
  - CoreCrypto
  - CoreText
  - Dev Tools
  - Disk Images
  - dyld
  - EFI
  - Finder
  - Game Center
  - Heimdal
  - ICU
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAudioFamily
  - IOGraphics
  - IOHIDFamily
  - IOStorageFamily
  - Kernel
  - libc
  - libpthread
  - libxpc
  - Login Window
  - lukemftpd
  - Mail
  - Multipeer Connectivity
  - NetworkExtension
  - Notes
  - OpenSSH
  - OpenSSL
  - procmail
  - remote_cmds
  - removefile
  - Ruby
  - Safari
  - Safari Downloads
  - Safari Extensions
  - Safari Safe Browsing
  - Security
  - SMB
  - SQLite
  - Telephony
  - Terminal
  - tidy
  - Time Machine
  - WebKit
  - WebKit CSS
  - WebKit JavaScript Bindings
  - WebKit Page Loading
  - WebKit Plug-ins

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

  - The libgmp library in some cases terminated unexpectedly     with a segmentation fault when being used with other     libraries that use the GMP memory management. With this     update, PHP no longer changes libgmp memory allocators,     which prevents the described crash from occurring.

  - When using the Open Database Connectivity (ODBC) API,     the PHP process in some cases terminated unexpectedly     with a segmentation fault. The underlying code has been     adjusted to prevent this crash.

  - Previously, running PHP on a big-endian system sometimes     led to memory corruption in the fileinfo module. This     update adjusts the behavior of the PHP pointer so that     it can be freed without causing memory corruption.

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 5.4.x earlier than 5.4.40, 5.5.x earlier than 5.5.24, or 5.6.x earlier than 5.6.8 are exposed to the following issues :

  - An out-of-bounds read overflow error exists in the function 'GetCode_()' in file 'gd_gif_in.c' that allows denial of service attacks or disclosure of memory contents. (CVE-2014-9709)
  - A use-after-free error exists in the OPcache extension in the '_zend_shared_memdup()' function within the file 'zend_shared_alloc.c'. A remote attacker can exploit this to cause a denial of service or possibly have other unspecified impact. (CVE-2015-1351)
  - The function 'build_tablename()' in file 'pgsql.c' in the PostgreSQL extension does not properly validate token extraction for table names. A remote attacker, using a crafted name, can exploit this to cause a NULL pointer deference, leading to a denial of service. (CVE-2015-1352)
  - A use-after-free error exists in the function 'phar_rename_archive()' in file 'phar_object.c'. A remote attacker, by attempting to rename a phar archive to an already existing file name, can exploit this to cause a denial of service. (CVE-2015-2301)
  - A buffer read overflow error exists in the Phar component due to user-supplied input not being validated properly when handling phar parsing during 'unserialize()' function calls. An attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-2783)
  - A buffer overflow flaw exists in the 'phar_set_inode()' function in file 'phar_internal.h' when handling archive files, such as tar, zip, or phar files. A remote attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-3329)
  - A flaw exists in the Apache2handler SAPI component, when handling pipelined HTTP requests, that a remote attacker can exploit to execute arbitrary code. (CVE-2015-3330)
  - An information disclosure vulnerability exists because of a type confusion error. Specifically, this issue occurs when the 'unserialize()' function is used with SoapFault object's '__toString()' function. An attacker can exploit this issue to leak arbitrary memory blocks.
  - A flaw exists in the 'phar_parse_metadata()' function in 'ext/phar/phar.c'. The issue is triggered as user-supplied input is not properly validated when parsing a specially crafted TAR file. This may allow a remote attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-3307)
  - A type confusion flaw exists in the '__toString()' method in 'incomplete_class.c' that may allow a context-dependent attacker to leak arbitrary memory blocks or potentially cause a denial of service. (CVE-2015-4602)
  - Multiple unspecified issues exist in '/soap/php_http.c' and '/soap/php_encoding.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-4601)
  - A denial of service vulnerability affects Fine Free File, a common component used in PHP known as 'file'. Specifically, this issue affects the source file 'libmagic/softmagic.c' because it fails to properly handle offsets that exceed 'bytecnt' or vice versa. (CVE-2015-4605)

PHP was updated to fix three security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3330: Specially crafted PHAR files could, when     executed under Apache httpd 2.4 (apache2handler), allow     arbitrary code execution (bnc#928506)

  - CVE-2015-3329: Specially crafted PHAR data could lead to     disclosure of sensitive information due to a buffer     overflow (bnc#928506)

  - CVE-2015-2783: Specially crafted PHAR data could lead to     disclosure of sensitive information due to a buffer     over-read (bnc#928511)

On openSUSE 13.2, the following bug was fixed :

  - boo#927147: php5-fpm did not start correctly

CVE-2014-9705 Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2015-0232 The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a JPEG image.

CVE-2015-2301 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

CVE-2015-2331 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a ZIP archive that contains many entries, leading to a heap-based buffer overflow.

CVE-2015-2783 Buffer Over-read in unserialize when parsing Phar

CVE-2015-2787 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231.

CVE-2015-3329 Buffer Overflow when parsing tar/zip/phar in phar_set_inode)

CVE-2015-3330 PHP potential remote code execution with apache 2.4 apache2handler

CVE-2015-temp-68819 denial of service when processing a crafted file with Fileinfo

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated php packages fix security vulnerabilities :

Buffer Over-read in unserialize when parsing Phar (CVE-2015-2783).

Buffer Overflow when parsing tar/zip/phar in phar_set_inode (CVE-2015-3329).

Potential remote code execution with apache 2.4 apache2handler (CVE-2015-3330).

PHP has been updated to version 5.5.24, which fixes these issues and other bugs.

Additionally the timezonedb packages has been upgraded to the latest version and the PECL packages which requires so has been rebuilt for php-5.5.24.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.24. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.40. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the GetCode_()     function within file gd_gif_in.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2014-9709)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - A use-after-free error exists in the     phar_rename_archive() function within file     phar_object.c. An unauthenticated, remote attacker can     exploit this, by attempting to rename a phar archive to     an already existing file name, to cause a denial of     service condition. (CVE-2015-2301)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2572-1 advisory.

    It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2015-3330)

    It was discovered that PHP incorrectly handled opening tar, zip or phar archives through the PHAR     extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2015-3329)

    It was discovered that PHP incorrectly handled regular expressions. A remote attacker could use this issue     to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-2305)

    Paulos Yibelo discovered that PHP incorrectly handled moving files when a pathname contained a null     character. A remote attacker could use this issue to possibly bypass filename restrictions. This issue     only applied to Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2348)

    It was discovered that PHP incorrectly handled unserializing PHAR files. A remote attacker could use this     issue to cause PHP to possibly expose sensitive information. (CVE-2015-2783)

    Taoguang Chen discovered that PHP incorrectly handled unserializing certain objects. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-2787)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
193682	RHEL 6 / 7 : php54 (RHSA-2015:1066)	Nessus	Red Hat Local Security Checks	critical
181083	Oracle Linux 7 : php55-php (ELSA-2015-1186)	Nessus	Oracle Linux Local Security Checks	critical
181066	Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)	Nessus	Oracle Linux Local Security Checks	critical
124998	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1545)	Nessus	Huawei Local Security Checks	critical
98831	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
119964	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:0868-1)	Nessus	SuSE Local Security Checks	high
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
8982	Mac OS X < 10.11 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
86270	Mac OS X < 10.11 Multiple Vulnerabilities (GHOST)	Nessus	MacOS X Local Security Checks	critical
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
84394	Scientific Linux Security Update : php on SL7.x x86_64 (20150623)	Nessus	Scientific Linux Local Security Checks	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	critical
8784	PHP 5.4.x < 5.4.40 / 5.5.x < 5.5.24 / 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
83391	openSUSE Security Update : php5 (openSUSE-2015-352)	Nessus	SuSE Local Security Checks	high
83144	Debian DLA-212-1 : php5 security update	Nessus	Debian Local Security Checks	high
83101	Mandriva Linux Security Advisory : php (MDVSA-2015:209)	Nessus	Mandriva Local Security Checks	high
83035	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83034	PHP 5.5.x < 5.5.24 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83033	PHP 5.4.x < 5.4.40 Multiple Vulnerabilities	Nessus	CGI abuses	critical
82923	Slackware 14.0 / 14.1 / current : php (SSA:2015-111-10)	Nessus	Slackware Local Security Checks	high
82911	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2572-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-3330

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

critical

high

critical

high

high

critical

critical

critical

critical

critical

high

high

high

critical

critical

critical

high

medium