The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory.

  - php: use after free vulnerability in unserialize() (CVE-2014-8142)

  - php: out of bounds read when parsing a crafted .php file (CVE-2014-9427)

  - file: out of bounds read in mconvert() (CVE-2014-9652)

  - php: heap buffer overflow in enchant_broker_request_dict() (CVE-2014-9705)

  - gd: buffer read overflow in gd_gif_in.c (CVE-2014-9709)

  - php: use after free vulnerability in unserialize() (incomplete fix of CVE-2014-8142) (CVE-2015-0231)

  - php: Free called on unitialized pointer in exif.c (CVE-2015-0232)

  - php: use after free vulnerability in unserialize() with DateTimeZone (CVE-2015-0273)

  - php: use after free in opcache extension (CVE-2015-1351)

  - php: use after free in phar_object.c (CVE-2015-2301)

  - regex: heap overflow in regcomp() on 32-bit architectures (CVE-2015-2305)

  - php: move_uploaded_file() NUL byte injection in file name (CVE-2015-2348)

  - php: buffer over-read in Phar metadata parsing (CVE-2015-2783)

  - php: use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re     (CVE-2015-2787)

  - php: invalid pointer free() in phar_tar_process_metadata() (CVE-2015-3307)

  - php: buffer overflow in phar_set_inode() (CVE-2015-3329)

  - php: pipelined request executed in deinitialized interpreter under httpd 2.4 (CVE-2015-3330)

  - php: missing null byte checks for paths in various PHP extensions (CVE-2015-3411, CVE-2015-3412)

  - php: SoapClient's __call() type confusion through unserialize() (CVE-2015-4147)

  - php: SoapClient's do_soap_call() type confusion after unserialize() (CVE-2015-4148)

  - php: type confusion issue in unserialize() with various SOAP methods (CVE-2015-4599, CVE-2015-4600,     CVE-2015-4601)

  - php: Incomplete Class unserialization type confusion (CVE-2015-4602)

  - php: exception::getTraceAsString type confusion issue after unserialize (CVE-2015-4603)

  - php: denial of service when processing a crafted file with Fileinfo (CVE-2015-4604, CVE-2015-4605)

  - php: HTTP response splitting in header() function (CVE-2015-8935)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1186 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - pgsql: fix NULL pointer dereference CVE-2015-1352

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory.

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys within     the serialized properties of an object, a different vulnerability than CVE-2004-1019. (CVE-2014-8142)

  - The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before     5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length     field during a copy of a truncated version of a Pascal string, which might allow remote attackers to cause     a denial of service (out-of-bounds memory access and application crash) via a crafted file.
    (CVE-2014-9652)

  - Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary     code via vectors that trigger creation of multiple dictionaries. (CVE-2014-9705)

  - The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x     before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application     crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.
    (CVE-2014-9709)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys     within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete     fix for CVE-2014-8142. (CVE-2015-0231)

  - The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x     before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized     pointer free and application crash) via crafted EXIF data in a JPEG image. (CVE-2015-0232)

  - Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22,     and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input     containing a (1) R or (2) r type specifier in (a) DateTimeZone data handled by the     php_date_timezone_initialize_from_hash function or (b) DateTime data handled by the     php_date_initialize_from_hash function. (CVE-2015-0273)

  - Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and     5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other     impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.
    (CVE-2015-2301)

  - The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows     remote attackers to bypass intended extension restrictions and create files with unexpected names via a     crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243.
    (CVE-2015-2348)

  - ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to obtain sensitive information from process memory or cause a denial of service (buffer over-read and     application crash) via a crafted length value in conjunction with crafted serialized data in a phar     archive, related to the phar_parse_metadata and phar_parse_pharfile functions. (CVE-2015-2783)

  - Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in     PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute     arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup     function, a related issue to CVE-2015-0231. (CVE-2015-2787)

  - The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly     have unspecified other impact via a crafted tar archive. (CVE-2015-3307)

  - Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before     5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a     crafted length value in a (1) tar, (2) phar, or (3) ZIP archive. (CVE-2015-3329)

  - The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24,     and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a     denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that     result in a deconfigured interpreter. (CVE-2015-3330)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read or write to arbitrary files via crafted input to an     application that calls (1) a DOMDocument load method, (2) the xmlwriter_open_uri function, (3) the     finfo_file function, or (4) the hash_hmac_file function, as demonstrated by a filename\0.xml attack that     bypasses an intended configuration in which client users may read only .xml files. (CVE-2015-3411)

  - PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00     sequences, which might allow remote attackers to read arbitrary files via crafted input to an application     that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a     filename\0.extension attack that bypasses an intended configuration in which client users may read files     with only one specific extension. (CVE-2015-3412)

  - The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x     before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute     arbitrary code by providing crafted serialized data with an unexpected data type, related to a type     confusion issue. (CVE-2015-4147)

  - The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before     5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive     information by providing crafted serialized data with an int data type, related to a type confusion     issue. (CVE-2015-4148)

  - The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service     (application crash), or possibly execute arbitrary code via an unexpected data type, related to a type     confusion issue. (CVE-2015-4599)

  - The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows     remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via     an unexpected data type, related to type confusion issues in the (1) SoapClient::__getLastRequest, (2)     SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4)     SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie     methods. (CVE-2015-4600)

  - PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly     execute arbitrary code via an unexpected data type, related to type confusion issues in (1)     ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than     CVE-2015-4600. (CVE-2015-4601)

  - The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or     possibly execute arbitrary code via an unexpected data type, related to a type confusion issue.
    (CVE-2015-4602)

  - The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data     type, related to a type confusion issue. (CVE-2015-4603)

  - The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship,     which allows remote attackers to cause a denial of service (application crash) or possibly execute     arbitrary code via a crafted string that is mishandled by a Python script text executable rule.
    (CVE-2015-4604)

  - The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40,     5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which     allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary     code via a crafted string that is mishandled by a Python script text executable rule. (CVE-2015-4605)

  - sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through     5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during     processing of an invalid file that begins with a # character and lacks a newline character, which causes     an out-of-bounds read and might (1) allow remote attackers to obtain sensitive information from php-cgi     process memory by leveraging the ability to upload a .php file or (2) trigger unexpected code execution if     a valid PHP script is present in memory locations adjacent to the mapping. (CVE-2014-9427)

  - Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache     extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have     unspecified other impact via unknown vectors. (CVE-2015-1351)

  - Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer)     alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-     dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based     buffer overflow. (CVE-2015-2305)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An integer underflow flaw leading to out-of-bounds     memory access was found in the way PHP's Phar extension     parsed Phar archives. A specially crafted archive could     cause PHP to crash or, possibly, execute arbitrary code     when opened.(CVE-2015-4021)

  - An out of bounds read flaw was found in the way the     xmlrpc extension parsed dates in the ISO 8601 format. A     specially crafted XML-RPC request or response could     possibly cause a PHP application to     crash.(CVE-2014-3668)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4598)

  - A flaw was found in the way PHP handled malformed     source files when running in CGI mode. A specially     crafted PHP file could cause PHP CGI to     crash.(CVE-2014-9427)

  - An issue was discovered in PHP before 5.6.36, 7.0.x     before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before     7.2.5. ext/ldap/ldap.c allows remote LDAP servers to     cause a denial of service (NULL pointer dereference and     application crash) because of mishandling of the     ldap_get_dn return value.(CVE-2018-10548)

  - An infinite loop vulnerability was found in     ext/iconv/iconv.c in PHP due to the iconv stream not     rejecting invalid multibyte sequences. A remote     attacker could use this vulnerability to hang the php     process and consume resources.(CVE-2018-10546)

  - The openssl_x509_parse function in openssl.c in the     OpenSSL module in PHP before 5.4.18 and 5.5.x before     5.5.2 does not properly handle a '\\0' character in a     domain name in the Subject Alternative Name field of an     X.509 certificate, which allows man-in-the-middle     attackers to spoof arbitrary SSL servers via a crafted     certificate issued by a legitimate Certification     Authority, a related issue to     CVE-2009-2408.(CVE-2013-4248)

  - A use-after-free flaw was found in the way PHP's     unserialize() function processed data. If a remote     attacker was able to pass crafted input to PHP's     unserialize() function, they could cause the PHP     interpreter to crash or, possibly, execute arbitrary     code.(CVE-2015-0231)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4602)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-3412)

  - The mcopy function in softmagic.c in file 5.x, as used     in the Fileinfo component in PHP before 5.4.40, 5.5.x     before 5.5.24, and 5.6.x before 5.6.8, does not     properly restrict a certain offset value, which allows     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a crafted string that is mishandled by a 'Python     script text executable' rule.(CVE-2015-4605)

  - A heap buffer overflow flaw was found in the     enchant_broker_request_dict() function of PHP's enchant     extension. A specially crafted tag input could possibly     cause a PHP application to crash.(CVE-2014-9705)

  - A buffer overflow flaw was found in the Exif extension.
    A specially crafted JPEG or TIFF file could cause a PHP     application using the exif_thumbnail() function to     crash or, possibly, execute arbitrary code with the     privileges of the user running that PHP     application.(CVE-2014-3670)

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4148)

  - A type confusion issue was found in the SPL ArrayObject     and SPLObjectStorage classes' unserialize() method. A     remote attacker able to submit specially crafted input     to a PHP application, which would then unserialize this     input using one of the aforementioned methods, could     use this flaw to execute arbitrary code with the     privileges of the user running that PHP     application.(CVE-2014-3515)

  - The mget function in softmagic.c in file 5.x, as used     in the Fileinfo component in PHP before 5.4.40, 5.5.x     before 5.5.24, and 5.6.x before 5.6.8, does not     properly maintain a certain pointer relationship, which     allows remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a crafted string that is mishandled by a 'Python     script text executable' rule.(CVE-2015-4604)

  - A NULL pointer dereference flaw was found in the     gdImageCreateFromXpm() function of PHP's gd extension.
    A remote attacker could use this flaw to crash a PHP     application using gd via a specially crafted X PixMap     (XPM) file.(CVE-2014-2497)

  - A flaw was found in the way PHP parsed multipart HTTP     POST requests. A specially crafted request could cause     PHP to use an excessive amount of CPU     time.(CVE-2015-4024)

  - Multiple flaws were discovered in the way PHP's Soap     extension performed object unserialization. Specially     crafted input processed by the unserialize() function     could cause a PHP application to disclose portion of     its memory or crash.(CVE-2015-4599)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4603)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

 - An unspecified use-after-free error exists in the _zend_shared_memdup() function within file ext/opcache/zend_shared_alloc.c that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2015-1351)

 - A NULL pointer dereference flaw exists in the build_tablename() function within file pgsql.c in the PostgreSQL extension due to a failure to validate token extraction for table names. An authenticated, remote attacker can exploit this, via a crafted name, to cause a denial of service condition. (CVE-2015-1352)

 - An out-of-bounds read error exists in the Phar component due to improper validation of user-supplied input when handling phar parsing during unserialize() function calls. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. (CVE-2015-2783)

 - A memory corruption issue exists in the phar_parse_metadata() function in file ext/phar/phar.c due to improper validation of user-supplied input when parsing a specially crafted TAR archive. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3307)

 - Multiple stack-based buffer overflow conditions exist in the phar_set_inode() function in file phar_internal.h when handling archive files, such as tar, zip, or phar files. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or the execution or arbitrary code. (CVE-2015-3329)

 - A flaw exists in the Apache2handler SAPI component when handling pipelined HTTP requests that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3330)

 - A flaw exists in multiple functions due to a failure to check for NULL byte (%00) sequences in a path when processing or reading a file. An unauthenticated, remote attacker can exploit this, via specially crafted input to an application calling those functions, to bypass intended restrictions and disclose potentially sensitive information. (CVE-2015-3411, CVE-2015-3412)

 - A type confusion error exists in multiple functions within file ext/soap/soap.c that is triggered when calling unserialize(). An unauthenticated, remote attacker can exploit this to disclose memory contents, cause a denial of service condition, or execute arbitrary code. (CVE-2015-4599, CVE-2015-4600)

 - Multiple type confusion errors exist within files ext/soap/php_encoding.c, ext/soap/php_http.c, and ext/soap/soap.c that allow an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4601)

 - A type confusion error exists in the __PHP_Incomplete_Class() function within file ext/standard/incomplete_class.c that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4602)

 - A type confusion error exists in the exception::getTraceAsString() function within file Zend/zend_exceptions.c that allows a remote attacker to execute arbitrary code. (CVE-2015-4603)

 - A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mget() function within file softmagic.c. The function fails to maintain a certain pointer relationship. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4604)

 - A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mcopy() function within file softmagic.c. The function fails to properly handle an offset that exceeds 'bytecnt'. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4605)

 - A use-after-free error exists in the sqlite3_close() function within file /ext/sqlite3/sqlite3.c when closing database connections. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - A flaw exists in the ZEND_VM_HELPER_EX() function within file /Zend/zend_vm_def.h when handling a __get() function call. An unauthenticated, remote attacker can exploit this to cause a cause a denial of service condition.

 - A type confusion error exists in the php_stream_url_wrap_http_ex() function within file ext/standard/http_fopen_wrapper.c that allows an unauthenticated, remote attacker to execute arbitrary code.

 - A use-after-free error exists in the php_curl() function within file ext/curl/interface.c that allows an unauthenticated, remote attacker to execute arbitrary code.

 - A use-after-free error exists in the SPL component, specifically in the spl_object_storage_get_gc() function within file ext/spl/spl_observer.c. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - A NULL pointer dereference flaw exists within file /ext/ereg/regex/regcomp.c that allows an unauthenticated, remote attacker attacker to cause a denial of service condition.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

This security update of PHP fixes the following issues :

Security issues fixed :

  - CVE-2015-4024 [bnc#931421]: Fixed multipart/form-data     remote DOS Vulnerability.

  - CVE-2015-4026 [bnc#931776]: pcntl_exec() did not check     path validity.

  - CVE-2015-4022 [bnc#931772]: Fixed and overflow in     ftp_genlist() that resulted in a heap overflow.

  - CVE-2015-4021 [bnc#931769]: Fixed memory corruption in     phar_parse_tarfile when entry filename starts with NULL.

  - CVE-2015-4148 [bnc#933227]: Fixed SoapClient's     do_soap_call() type confusion after unserialize()     information disclosure.

  - CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class     unserialization type confusion.

  - CVE-2015-4599, CVE-2015-4600, CVE-2015-4601     [bnc#935226]: Fixed type confusion issues in     unserialize() with various SOAP methods.

  - CVE-2015-4603 [bnc#935234]: Fixed     exception::getTraceAsString type confusion issue after     unserialize.

  - CVE-2015-4644 [bnc#935274]: Fixed a crash in     php_pgsql_meta_data.

  - CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in     ftp_genlist() that could result in a heap overflow.

  - CVE-2015-3411, CVE-2015-3412, CVE-2015-4598     [bnc#935227], [bnc#935232]: Added missing null byte     checks for paths in various PHP extensions.

Bugs fixed :

  - configure php-fpm with --localstatedir=/var [bnc#927147]

  - fix timezone map [bnc#919080]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2015-4599 The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

CVE-2015-4600 The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.

CVE-2015-4601 PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to 'type confusion' issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.

CVE-2015-4602 The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

CVE-2015-4603 The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a 'type confusion' issue.

CVE-2015-4604 The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a certain pointer relationship, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a 'Python script text executable' rule.

CVE-2015-4605 The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a 'Python script text executable' rule.

- CVE-2015-3307 The phar_parse_metadata function in     ext/phar/phar.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to cause a denial of service (heap metadata corruption)     or possibly have unspecified other impact via a crafted     tar archive.

  - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing     null byte checks for paths in various PHP extensions)

  - CVE-2015-4021 The phar_parse_tarfile function in     ext/phar/tar.c in PHP before 5.4.41, 5.5.x before     5.5.25, and 5.6.x before 5.6.9 does not verify that the     first character of a filename is different from the \0     character, which allows remote attackers to cause a     denial of service (integer underflow and memory     corruption) via a crafted entry in a tar archive.

  - CVE-2015-4022 Integer overflow in the ftp_genlist     function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x     before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.

  - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25,     and 5.6.x before 5.6.9 truncates a pathname upon     encountering a \x00 character in certain situations,     which allows remote attackers to bypass intended     extension restrictions and access files or directories     with unexpected names via a crafted argument to (1)     set_include_path, (2) tempnam, (3) rmdir, or (4)     readlink. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2006-7243.

  - CVE-2015-4026 The pcntl_exec implementation in PHP     before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before     5.6.9 truncates a pathname upon encountering a \x00     character, which might allow remote attackers to bypass     intended extension restrictions and execute files with     unexpected names via a crafted first argument. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2006-7243.

  - CVE-2015-4147 The SoapClient::__call method in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that
    __default_headers is an array, which allows remote     attackers to execute arbitrary code by providing crafted     serialized data with an unexpected data type, related to     a 'type confusion' issue.

  - CVE-2015-4148 The do_soap_call function in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that the     uri property is a string, which allows remote attackers     to obtain sensitive information by providing crafted     serialized data with an int data type, related to a     'type confusion' issue.

  - CVE-2015-4598 Incorrect handling of paths with NULs

  - CVE-2015-4599 Type confusion vulnerability in     exception::getTraceAsString

  - CVE-2015-4600 + CVE-2015-4601 Added type checks

  - CVE-2015-4602 Type Confusion Infoleak Vulnerability in     unserialize() with SoapFault

  - CVE-2015-4604 + CVE-2015-4605 denial of service when     processing a crafted file with Fileinfo (already fixed     in CVE-2015-temp-68819.patch)

  - CVE-2015-4643 Improved fix for bug #69545 (Integer     overflow in ftp_genlist() resulting in heap overflow)

  - CVE-2015-4644 Fixed bug #69667 (segfault in     php_pgsql_meta_data)

  - CVE-2015-5589 Segfault in Phar::convertToData on invalid     file

  - CVE-2015-5590 Buffer overflow and stack smashing error     in phar_fix_filepath

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PHP script interpreter was updated to fix various security issues :

CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class unserialization type confusion.

CVE-2015-4599, CVE-2015-4600, CVE-2015-4601 [bnc#935226]: Fixed type confusion issues in unserialize() with various SOAP methods.

CVE-2015-4603 [bnc#935234]: Fixed exception::getTraceAsString type confusion issue after unserialize.

CVE-2015-4644 [bnc#935274]: Fixed a crash in php_pgsql_meta_data.

CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in ftp_genlist() that could result in a heap overflow.

CVE-2015-3411, CVE-2015-3412, CVE-2015-4598 [bnc#935227], [bnc#935232]: Added missing null byte checks for paths in various PHP extensions.

CVE-2015-4148 [bnc#933227]: Fixed a SoapClient's do_soap_call() type confusion after unserialize() information disclosure.

Also the following bug were fixed :

fix a segmentation fault in odbc_fetch_array [bnc#935074]

fix timezone map [bnc#919080]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory.

    - fix patch for CVE-2015-4024
    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
    - core: fix use-after-free in unserialize CVE-2015-2787
    - exif: fix free on unitialized pointer CVE-2015-0232
    - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
    - date: fix use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - phar: use after free in phar_object.c CVE-2015-2301

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2658-1 advisory.

    Neal Poole and Tomas Hoger discovered that PHP incorrectly handled NULL bytes in file paths. A remote     attacker could possibly use this issue to bypass intended restrictions and create or obtain access to     sensitive files. (CVE-2015-3411, CVE-2015-3412, CVE-2015-4025, CVE-2015-4026, CVE-2015-4598)

    Emmanuel Law discovered that the PHP phar extension incorrectly handled filenames starting with a NULL     byte. A remote attacker could use this issue with a crafted tar archive to cause a denial of service.
    (CVE-2015-4021)

    Max Spelsberg discovered that PHP incorrectly handled the LIST command when connecting to remote FTP     servers. A malicious FTP server could possibly use this issue to execute arbitrary code. (CVE-2015-4022,     CVE-2015-4643)

    Shusheng Liu discovered that PHP incorrectly handled certain malformed form data. A remote attacker could     use this issue with crafted form data to cause CPU consumption, leading to a denial of service.
    (CVE-2015-4024)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue with crafted serialized data to possibly execute arbitrary code. (CVE-2015-4147)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated that the uri property is a     string. A remote attacker could use this issue with crafted serialized data to possibly obtain sensitive     information. (CVE-2015-4148)

    Taoguang Chen discovered that PHP incorrectly validated data types in multiple locations. A remote     attacker could possibly use these issues to obtain sensitive information or cause a denial of service.
    (CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

    It was discovered that the PHP Fileinfo component incorrectly handled certain files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. This issue only affected     Ubuntu 15.04. (CVE-2015-4604, CVE-2015-4605)

    It was discovered that PHP incorrectly handled table names in php_pgsql_meta_data. A local attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-4644)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PHP script interpreter was updated to receive various security fixes :

  - CVE-2015-4602 [bnc#935224]: Fixed an incomplete Class     unserialization type confusion.

  - CVE-2015-4599, CVE-2015-4600, CVE-2015-4601     [bnc#935226]: Fixed type confusion issues in     unserialize() with various SOAP methods.

  - CVE-2015-4603 [bnc#935234]: Fixed     exception::getTraceAsString type confusion issue after     unserialize.

  - CVE-2015-4644 [bnc#935274]: Fixed a crash in     php_pgsql_meta_data.

  - CVE-2015-4643 [bnc#935275]: Fixed an integer overflow in     ftp_genlist() that could result in a heap overflow.

  - CVE-2015-3411, CVE-2015-3412, CVE-2015-4598     [bnc#935227], [bnc#935232]: Added missing null byte     checks for paths in various PHP extensions.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

  - The libgmp library in some cases terminated unexpectedly     with a segmentation fault when being used with other     libraries that use the GMP memory management. With this     update, PHP no longer changes libgmp memory allocators,     which prevents the described crash from occurring.

  - When using the Open Database Connectivity (ODBC) API,     the PHP process in some cases terminated unexpectedly     with a segmentation fault. The underlying code has been     adjusted to prevent this crash.

  - Previously, running PHP on a big-endian system sometimes     led to memory corruption in the fileinfo module. This     update adjusts the behavior of the PHP pointer so that     it can be freed without causing memory corruption.

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 5.4.x earlier than 5.4.40, 5.5.x earlier than 5.5.24, or 5.6.x earlier than 5.6.8 are exposed to the following issues :

  - An out-of-bounds read overflow error exists in the function 'GetCode_()' in file 'gd_gif_in.c' that allows denial of service attacks or disclosure of memory contents. (CVE-2014-9709)
  - A use-after-free error exists in the OPcache extension in the '_zend_shared_memdup()' function within the file 'zend_shared_alloc.c'. A remote attacker can exploit this to cause a denial of service or possibly have other unspecified impact. (CVE-2015-1351)
  - The function 'build_tablename()' in file 'pgsql.c' in the PostgreSQL extension does not properly validate token extraction for table names. A remote attacker, using a crafted name, can exploit this to cause a NULL pointer deference, leading to a denial of service. (CVE-2015-1352)
  - A use-after-free error exists in the function 'phar_rename_archive()' in file 'phar_object.c'. A remote attacker, by attempting to rename a phar archive to an already existing file name, can exploit this to cause a denial of service. (CVE-2015-2301)
  - A buffer read overflow error exists in the Phar component due to user-supplied input not being validated properly when handling phar parsing during 'unserialize()' function calls. An attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-2783)
  - A buffer overflow flaw exists in the 'phar_set_inode()' function in file 'phar_internal.h' when handling archive files, such as tar, zip, or phar files. A remote attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-3329)
  - A flaw exists in the Apache2handler SAPI component, when handling pipelined HTTP requests, that a remote attacker can exploit to execute arbitrary code. (CVE-2015-3330)
  - An information disclosure vulnerability exists because of a type confusion error. Specifically, this issue occurs when the 'unserialize()' function is used with SoapFault object's '__toString()' function. An attacker can exploit this issue to leak arbitrary memory blocks.
  - A flaw exists in the 'phar_parse_metadata()' function in 'ext/phar/phar.c'. The issue is triggered as user-supplied input is not properly validated when parsing a specially crafted TAR file. This may allow a remote attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-3307)
  - A type confusion flaw exists in the '__toString()' method in 'incomplete_class.c' that may allow a context-dependent attacker to leak arbitrary memory blocks or potentially cause a denial of service. (CVE-2015-4602)
  - Multiple unspecified issues exist in '/soap/php_http.c' and '/soap/php_encoding.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-4601)
  - A denial of service vulnerability affects Fine Free File, a common component used in PHP known as 'file'. Specifically, this issue affects the source file 'libmagic/softmagic.c' because it fails to properly handle offsets that exceed 'bytecnt' or vice versa. (CVE-2015-4605)

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.24. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.40. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the GetCode_()     function within file gd_gif_in.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2014-9709)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - A use-after-free error exists in the     phar_rename_archive() function within file     phar_object.c. An unauthenticated, remote attacker can     exploit this, by attempting to rename a phar archive to     an already existing file name, to cause a denial of     service condition. (CVE-2015-2301)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
193682	RHEL 6 / 7 : php54 (RHSA-2015:1066)	Nessus	Red Hat Local Security Checks	critical
181083	Oracle Linux 7 : php55-php (ELSA-2015-1186)	Nessus	Oracle Linux Local Security Checks	critical
181066	Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)	Nessus	Oracle Linux Local Security Checks	critical
124997	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1544)	Nessus	Huawei Local Security Checks	critical
98831	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
119968	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1253-1)	Nessus	SuSE Local Security Checks	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	critical
88811	F5 Networks BIG-IP : Multiple PHP vulnerabilities (K17061)	Nessus	F5 Networks Local Security Checks	critical
85808	Debian DLA-307-1 : php5 security update	Nessus	Debian Local Security Checks	critical
84897	SUSE SLES11 Security Update : PHP (SUSE-SU-2015:1265-1)	Nessus	SuSE Local Security Checks	critical
84661	Scientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)	Nessus	Scientific Linux Local Security Checks	critical
84660	RHEL 6 : php (RHSA-2015:1218)	Nessus	Red Hat Local Security Checks	critical
84659	Oracle Linux 6 : php (ELSA-2015-1218)	Nessus	Oracle Linux Local Security Checks	critical
84648	CentOS 6 : php (CESA-2015:1218)	Nessus	CentOS Local Security Checks	critical
84563	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2658-1)	Nessus	Ubuntu Local Security Checks	critical
84557	openSUSE Security Update : php5 (openSUSE-2015-471)	Nessus	SuSE Local Security Checks	critical
84394	Scientific Linux Security Update : php on SL7.x x86_64 (20150623)	Nessus	Scientific Linux Local Security Checks	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	critical
8784	PHP 5.4.x < 5.4.40 / 5.5.x < 5.5.24 / 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
83035	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83034	PHP 5.5.x < 5.5.24 Multiple Vulnerabilities	Nessus	CGI abuses	critical
83033	PHP 5.4.x < 5.4.40 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2015-4602

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical