The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory.

  - php: use after free vulnerability in unserialize() (CVE-2014-8142)

  - php: out of bounds read when parsing a crafted .php file (CVE-2014-9427)

  - file: out of bounds read in mconvert() (CVE-2014-9652)

  - php: heap buffer overflow in enchant_broker_request_dict() (CVE-2014-9705)

  - gd: buffer read overflow in gd_gif_in.c (CVE-2014-9709)

  - php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142) (CVE-2015-0231)

  - php: Free called on unitialized pointer in exif.c (CVE-2015-0232)

  - php: use after free vulnerability in unserialize() with DateTimeZone (CVE-2015-0273)

  - php: use after free in opcache extension (CVE-2015-1351)

  - php: use after free in phar_object.c (CVE-2015-2301)

  - regex: heap overflow in regcomp() on 32-bit architectures (CVE-2015-2305)

  - php: move_uploaded_file() NUL byte injection in file name (CVE-2015-2348)

  - php: buffer over-read in Phar metadata parsing (CVE-2015-2783)

  - php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re     (CVE-2015-2787)

  - php: invalid pointer free() in phar_tar_process_metadata() (CVE-2015-3307)

  - php: buffer overflow in phar_set_inode() (CVE-2015-3329)

  - php: pipelined request executed in deinitialized interpreter under httpd 2.4 (CVE-2015-3330)

  - php: missing null byte checks for paths in various PHP extensions (CVE-2015-3411, CVE-2015-3412)

  - php: SoapClient's __call() type confusion through unserialize() (CVE-2015-4147)

  - php: SoapClient's do_soap_call() type confusion after unserialize() (CVE-2015-4148)

  - php: type confusion issue in unserialize() with various SOAP methods (CVE-2015-4599, CVE-2015-4600,     CVE-2015-4601)

  - php: Incomplete Class unserialization type confusion (CVE-2015-4602)

  - php: exception::getTraceAsString type confusion issue after unserialize (CVE-2015-4603)

  - php: denial of service when processing a crafted file with Fileinfo (CVE-2015-4604, CVE-2015-4605)

  - php: HTTP response splitting in header() function (CVE-2015-8935)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory.

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within     the serialized properties of an object, a different vulnerability than CVE-2004-1019. (CVE-2014-8142)

  - The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before     5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause     a denial of service (out-of-bounds memory access and application crash) via a crafted file.
    (CVE-2014-9652)

  - Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary     code via vectors that trigger creation of multiple dictionaries. (CVE-2014-9705)

  - The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x     before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application     crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
    (CVE-2014-9709)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys     within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete     fix for CVE-2014-8142. (CVE-2015-0231)

  - The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x     before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized     pointer free and application crash) via crafted EXIF data in a JPEG image. (CVE-2015-0232)

  - Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22,     and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input     containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the     php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the     php_date_initialize_from_hash function. (CVE-2015-0273)

  - Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and     5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other     impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.
    (CVE-2015-2301)

  - The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows     remote attackers to bypass intended extension restrictions and create files with unexpected names via a     crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
    (CVE-2015-2348)

  - ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to obtain sensitive information from process memory or cause a denial of service (buffer over-read and     application crash) via a crafted length value in conjunction with crafted serialized data in a phar     archive, related to the phar_parse_metadata and phar_parse_pharfile functions. (CVE-2015-2783)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup     function, a related issue to CVE-2015-0231. (CVE-2015-2787)

  - The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly     have unspecified other impact via a crafted tar archive. (CVE-2015-3307)

  - Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before     5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a     crafted length value in a (1) tar, (2) phar, or (3) ZIP archive. (CVE-2015-3329)

  - The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24,     and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a     denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that     result in a deconfigured interpreter. (CVE-2015-3330)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an     application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the     finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that     bypasses an intended configuration in which client users may read only .xml files. (CVE-2015-3411)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read arbitrary files via crafted input to an application     that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a     filename\0.extension attack that bypasses an intended configuration in which client users may read files     with only one specific extension. (CVE-2015-3412)

  - The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x     before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute     arbitrary code by providing crafted serialized data with an unexpected data type, related to a type     confusion issue. (CVE-2015-4147)

  - The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before     5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive     information by providing crafted serialized data with an int data type, related to a type confusion     issue. (CVE-2015-4148)

  - The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service     (application crash), or possibly execute arbitrary code via an unexpected data type, related to a type     confusion issue. (CVE-2015-4599)

  - The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows     remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via     an unexpected data type, related to type confusion issues in the (1) SoapClient::__getLastRequest, (2)     SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4)     SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie     methods. (CVE-2015-4600)

  - PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via an unexpected data type, related to type confusion issues in (1)     ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than     CVE-2015-4600. (CVE-2015-4601)

  - The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via an unexpected data type, related to a type confusion issue.
    (CVE-2015-4602)

  - The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data     type, related to a type confusion issue. (CVE-2015-4603)

  - The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship,     which allows remote attackers to cause a denial of service (application crash) or possibly execute     arbitrary code via a crafted string that is mishandled by a Python script text executable rule.
    (CVE-2015-4604)

  - The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which     allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary     code via a crafted string that is mishandled by a Python script text executable rule. (CVE-2015-4605)

  - sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through     5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during     processing of an invalid file that begins with a # character and lacks a newline character, which causes     an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi     process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if     a valid PHP script is present in memory locations adjacent to the mapping. (CVE-2014-9427)

  - Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache     extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have     unspecified other impact via unknown vectors. (CVE-2015-1351)

  - Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer)     alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-     dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based     buffer overflow. (CVE-2015-2305)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1053 advisory.

    - core: fix use-after-free vulnerability in the       process_nested_data function (unserialize) CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: fix use after free vulnerability in unserialize()       with DateTimeZone CVE-2015-0273
    - enchant: fix  heap buffer overflow in       enchant_broker_request_dict() CVE-2014-9705
    - ereg: fix heap overflow in regcomp() CVE-2015-2305
    - opcache: fix use after free CVE-2015-1351
    - phar: fix use after free in phar_object.c CVE-2015-2301
    - pgsql: fix NULL pointer dereference CVE-2015-1352

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4147)

  - An invalid free flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3307)

  - A flaw was found in the way the PHP module for the     Apache httpd web server handled pipelined requests. A     remote attacker could use this flaw to trigger the     execution of a PHP script in a deinitialized     interpreter, causing it to crash or, possibly, execute     arbitrary code.(CVE-2015-3330)

  - Multiple flaws were discovered in the way PHP's Soap     extension performed object unserialization. Specially     crafted input processed by the unserialize() function     could cause a PHP application to disclose portion of     its memory or crash.(CVE-2015-4600)

  - Zend/zend_exceptions.c in PHP, possibly 5.x before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (infinite loop) via a     crafted Exception object in serialized data, a related     issue to CVE-2015-8876.(CVE-2016-7478)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-3411)

  - The asn1_time_to_time_t function in     ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x     before 5.4.23, and 5.5.x before 5.5.7 does not properly     parse (1) notBefore and (2) notAfter timestamps in     X.509 certificates, which allows remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted certificate that is     not properly handled by the openssl_x509_parse     function.(CVE-2013-6420)

  - A use-after-free flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2301)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9024)

  - An issue was discovered in PHP before 7.1.27, 7.2.x     before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is     possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing,     thus enabling unauthorized users to access the     data.(CVE-2019-9637)

  - An issue was discovered in the EXIF component in PHP     before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an Invalid Read in     exif_process_SOFn.(CVE-2019-9640)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.7. It is, therefore, affected by multiple vulnerabilities :

 - A use-after-free error exists related to function 'unserialize', which can allow a remote attacker to execute arbitrary code. Note that this issue is due to an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

 - An integer overflow error exists in function 'regcomp' in the Henry Spencer regex library, due to improper validation of user-supplied input. An attacker can exploit this to cause a denial of service or to execute arbitrary code. (CVE-2015-2305)

 - An integer overflow error exists in the '_zip_cdir_new' function, due to improper validation of user-supplied input. An attacker, using a crafted ZIP archive, can exploit this to cause a denial of service or to execute arbitrary code. (CVE-2015-2331)

 - A filter bypass vulnerability exists due to a flaw in the move_uploaded_file() function in which pathnames are truncated when a NULL byte is encountered. This allows a remote attacker, via a crafted second argument, to bypass intended extension restrictions and create files with unexpected names. (CVE-2015-2348)

 - A user-after-free error exists in the process_nested_data() function. This allows a remote attacker, via a crafted unserialize call, to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-2787)

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

- CVE-2015-3307 The phar_parse_metadata function in     ext/phar/phar.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to cause a denial of service (heap metadata corruption)     or possibly have unspecified other impact via a crafted     tar archive.

  - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing     null byte checks for paths in various PHP extensions)

  - CVE-2015-4021 The phar_parse_tarfile function in     ext/phar/tar.c in PHP before 5.4.41, 5.5.x before     5.5.25, and 5.6.x before 5.6.9 does not verify that the     first character of a filename is different from the \0     character, which allows remote attackers to cause a     denial of service (integer underflow and memory     corruption) via a crafted entry in a tar archive.

  - CVE-2015-4022 Integer overflow in the ftp_genlist     function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x     before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.

  - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25,     and 5.6.x before 5.6.9 truncates a pathname upon     encountering a \x00 character in certain situations,     which allows remote attackers to bypass intended     extension restrictions and access files or directories     with unexpected names via a crafted argument to (1)     set_include_path, (2) tempnam, (3) rmdir, or (4)     readlink. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2006-7243.

  - CVE-2015-4026 The pcntl_exec implementation in PHP     before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before     5.6.9 truncates a pathname upon encountering a \x00     character, which might allow remote attackers to bypass     intended extension restrictions and execute files with     unexpected names via a crafted first argument. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2006-7243.

  - CVE-2015-4147 The SoapClient::__call method in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that
    __default_headers is an array, which allows remote     attackers to execute arbitrary code by providing crafted     serialized data with an unexpected data type, related to     a 'type confusion' issue.

  - CVE-2015-4148 The do_soap_call function in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that the     uri property is a string, which allows remote attackers     to obtain sensitive information by providing crafted     serialized data with an int data type, related to a     'type confusion' issue.

  - CVE-2015-4598 Incorrect handling of paths with NULs

  - CVE-2015-4599 Type confusion vulnerability in     exception::getTraceAsString

  - CVE-2015-4600 + CVE-2015-4601 Added type checks

  - CVE-2015-4602 Type Confusion Infoleak Vulnerability in     unserialize() with SoapFault

  - CVE-2015-4604 + CVE-2015-4605 denial of service when     processing a crafted file with Fileinfo (already fixed     in CVE-2015-temp-68819.patch)

  - CVE-2015-4643 Improved fix for bug #69545 (Integer     overflow in ftp_genlist() resulting in heap overflow)

  - CVE-2015-4644 Fixed bug #69667 (segfault in     php_pgsql_meta_data)

  - CVE-2015-5589 Segfault in Phar::convertToData on invalid     file

  - CVE-2015-5590 Buffer overflow and stack smashing error     in phar_fix_filepath

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory.

    - fix patch for CVE-2015-4024
    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
    - core: fix use-after-free in unserialize CVE-2015-2787
    - exif: fix free on unitialized pointer CVE-2015-0232
    - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
    - date: fix use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - phar: use after free in phar_object.c CVE-2015-2301

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory.

    Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote     attacker could possibly use this issue to bypass intended restrictions and create or obtain access to     sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598)

    Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL     byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service.
    (CVE-2015-4021)

    Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP     servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022,     CVE-2015-4643)

    Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could     use this issue with crafted form data to cause CPU consumption, leading to a denial of service.
    (CVE-2015-4024)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a     string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive     information. (CVE-2015-4148)

    Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote     attacker could possibly use these issues to obtain sensitive information or cause a denial of service.
    (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

    It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected     Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605)

    It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

  - The libgmp library in some cases terminated unexpectedly     with a segmentation fault when being used with other     libraries that use the GMP memory management. With this     update, PHP no longer changes libgmp memory allocators,     which prevents the described crash from occurring.

  - When using the Open Database Connectivity (ODBC) API,     the PHP process in some cases terminated unexpectedly     with a segmentation fault. The underlying code has been     adjusted to prevent this crash.

  - Previously, running PHP on a big-endian system sometimes     led to memory corruption in the fileinfo module. This     update adjusts the behavior of the PHP pointer so that     it can be freed without causing memory corruption.

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 5.4.x earlier than 5.4.39, 5.5.x earlier than 5.5.23, or 5.6.x earlier than 5.6.7 are exposed to the following issues :

  - A use-after-free error exists related to function 'unserialize', which can allow a remote attacker to execute arbitrary code. Note that this issue exists due to an incomplete fix for CVE-2014-8142. (Bug 68594 / CVE-2015-0231)

  - A heap-based buffer overflow error exists in function 'regcomp' in the Henry Spencer regex library due to improper validation of user-supplied input. An attacker can exploit this to cause a denial of service or to execute arbitrary code. (Bug 69248 / CVE-2015-2305)

  - An integer overflow error exists in the '_zip_cdir_new' function, due to improper validation of user-supplied input. An attacker, using a crafted ZIP archive, can exploit this to cause a denial of service or to execute arbitrary code. (Bug 69253 / CVE-2015-2331)

  - A filter bypass vulnerability exists due to a flaw in the move_uploaded_file() function in which pathnames are truncated when a NULL byte is encountered. This allows a remote attacker, via a crafted second argument, to bypass intended extension restrictions and create files with unexpected names. (Bug 69207 / CVE-2015-2348)

  - A use-after-free error exists in the process_nested_data() function. This allows a remote attacker, via a crafted unserialize call, to dereference already freed memory, resulting in the execution of arbitrary code. (Bug 68976 / CVE-2015-2787)

  - A type confusion flaw exists in the __call() method and do_soap_call() function in SoapClient that is triggered when handling arrays. This may allow a remote attacker to execute arbitrary code. (CVE-2015-4147, CVE-2015-4148)

According to its banner, the version of PHP 5.6.x installed on the remote host is prior to 5.6.7. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists related to function     'unserialize', which can allow a remote attacker to     execute arbitrary code. Note that this issue is due to     an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

  - An integer overflow error exists in function 'regcomp'     in the Henry Spencer regex library, due to improper     validation of user-supplied input. An attacker can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2305)

  - An integer overflow error exists in the '_zip_cdir_new'     function, due to improper validation of user-supplied     input. An attacker, using a crafted ZIP archive, can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2331)

  - A filter bypass vulnerability exists due to a flaw in     the move_uploaded_file() function in which pathnames are     truncated when a NULL byte is encountered. This allows a     remote attacker, via a crafted second argument, to     bypass intended extension restrictions and create files     with unexpected names. (CVE-2015-2348)

  - A user-after-free error exists in the     process_nested_data() function. This allows a remote     attacker, via a crafted unserialize call, to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-2787)

  - A type confusion vulnerability in the     SoapClient's __call() function in ext/soap/soap.c     could allow a remote attacker to execute arbitrary     code by providing crafted serialized data with an     unexpected data type (CVE-2015-4147, CVE-2015-4148)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.5.x installed on the remote host is prior to 5.5.23. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists related to function     'unserialize', which can allow a remote attacker to     execute arbitrary code. Note that this issue is due to     an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

  - An integer overflow error exists in function 'regcomp'     in the Henry Spencer regex library, due to improper     validation of user-supplied input. An attacker can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2305)

  - An integer overflow error exists in the '_zip_cdir_new'     function, due to improper validation of user-supplied     input. An attacker, using a crafted ZIP archive, can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2331)

  - A filter bypass vulnerability exists due to a flaw in     the move_uploaded_file() function in which pathnames are     truncated when a NULL byte is encountered. This allows a     remote attacker, via a crafted second argument, to     bypass intended extension restrictions and create files     with unexpected names. (CVE-2015-2348)

  - A user-after-free error exists in the     process_nested_data() function. This allows a remote     attacker, via a crafted unserialize call, to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-2787)

  - A type confusion vulnerability in the     SoapClient's __call() function in ext/soap/soap.c     could allow a remote attacker to execute arbitrary     code by providing crafted serialized data with an     unexpected data type (CVE-2015-4147, CVE-2015-4148)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x installed on the remote host is prior to 5.4.39. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists related to function     'unserialize', which can allow a remote attacker to     execute arbitrary code. Note that this issue is due to     an incomplete fix for CVE-2014-8142. (CVE-2015-0231)

  - An integer overflow error exists in function 'regcomp'     in the Henry Spencer regex library, due to improper     validation of user-supplied input. An attacker can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2305)

  - An integer overflow error exists in the '_zip_cdir_new'     function, due to improper validation of user-supplied     input. An attacker, using a crafted ZIP archive, can     exploit this to cause a denial of service or to execute     arbitrary code. (CVE-2015-2331)

  - A filter bypass vulnerability exists due to a flaw in     the move_uploaded_file() function in which pathnames are     truncated when a NULL byte is encountered. This allows a     remote attacker, via a crafted second argument, to     bypass intended extension restrictions and create files     with unexpected names. (CVE-2015-2348)

  - A user-after-free error exists in the     process_nested_data() function. This allows a remote     attacker, via a crafted unserialize call, to dereference     already freed memory, resulting in the execution of     arbitrary code. (CVE-2015-2787)

  - A type confusion vulnerability in the     SoapClient's __call() function in ext/soap/soap.c     could allow a remote attacker to execute arbitrary     code by providing crafted serialized data with an     unexpected data type (CVE-2015-4147, CVE-2015-4148)

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
193682	RHEL 6 / 7 : php54 (RHSA-2015:1066)	Nessus	Red Hat Local Security Checks	critical
181066	Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)	Nessus	Oracle Linux Local Security Checks	critical
181035	Oracle Linux 6 / 7 : php55 (ELSA-2015-1053)	Nessus	Oracle Linux Local Security Checks	critical
124998	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1545)	Nessus	Huawei Local Security Checks	critical
98830	PHP 5.6.x < 5.6.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
85808	Debian DLA-307-1 : php5 security update	Nessus	Debian Local Security Checks	critical
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
84661	Scientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)	Nessus	Scientific Linux Local Security Checks	critical
84660	RHEL 6 : php (RHSA-2015:1218)	Nessus	Red Hat Local Security Checks	critical
84659	Oracle Linux 6 : php (ELSA-2015-1218)	Nessus	Oracle Linux Local Security Checks	critical
84648	CentOS 6 : php (CESA-2015:1218)	Nessus	CentOS Local Security Checks	critical
84563	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)	Nessus	Ubuntu Local Security Checks	critical
84394	Scientific Linux Security Update : php on SL7.x x86_64 (20150623)	Nessus	Scientific Linux Local Security Checks	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	critical
8681	PHP 5.4.x < 5.4.39 / 5.5.x < 5.5.23 / 5.6.x < 5.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
82027	PHP 5.6.x < 5.6.7 Multiple Vulnerabilities	Nessus	CGI abuses	critical
82026	PHP 5.5.x < 5.5.23 Multiple Vulnerabilities	Nessus	CGI abuses	critical
82025	PHP 5.4.x < 5.4.39 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2015-4147

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical