Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ext/standard/var_unserializer.c in PHP before 5.6.25     and 7.x before 7.0.10 mishandles certain invalid     objects, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via crafted serialized data that leads to a (1)
    __destruct call or (2) magic method     call.(CVE-2016-7124)

  - Stack-based buffer overflow in ext/phar/tar.c in PHP     before 5.5.32, 5.6.x before 5.6.18, and 7.x before     7.0.3 allows remote attackers to cause a denial of     service (application crash) or possibly have     unspecified other impact via a crafted TAR     archive.(CVE-2016-2554)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6831)

  - The sapi_header_op function in main/SAPI.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before     5.6.6 supports deprecated line folding without     considering browser compatibility, which allows remote     attackers to conduct cross-site scripting (XSS) attacks     against Internet Explorer by leveraging (1) %0A%20 or     (2) %0D%0A%20 mishandling in the header     function.(CVE-2015-8935)

  - The openssl_random_pseudo_bytes function in     ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 incorrectly     relies on the deprecated RAND_pseudo_bytes function,     which makes it easier for remote attackers to defeat     cryptographic protection mechanisms via unspecified     vectors.(CVE-2015-8867)

  - Use-after-free vulnerability in the SPL unserialize     implementation in ext/spl/spl_array.c in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12     allows remote attackers to execute arbitrary code via     crafted serialized data that triggers misuse of an     array field.(CVE-2015-6832)

  - Directory traversal vulnerability in the PharData class     in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x     before 5.6.12 allows remote attackers to write to     arbitrary files via a .. (dot dot) in a ZIP archive     entry that is mishandled during an extractTo     call.(CVE-2015-6833)

  - Directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c in     PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x     before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before     3.12.1 allows remote attackers to create arbitrary     empty directories via a crafted ZIP     archive.(CVE-2014-9767)

  - The ZIP signature-verification feature in PHP before     5.6.26 and 7.x before 7.0.11 does not ensure that the     uncompressed_filesize field is large enough, which     allows remote attackers to cause a denial of service     (out-of-bounds memory access) or possibly have     unspecified other impact via a crafted PHAR archive,     related to ext/phar/util.c and     ext/phar/zip.c.(CVE-2016-7414)

  - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before     7.0.13 allows remote attackers to cause a denial of     service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.(CVE-2016-9934)

  - The php_wddx_push_element function in ext/wddx/wddx.c     in PHP before 5.6.29 and 7.x before 7.0.14 allows     remote attackers to cause a denial of service     (out-of-bounds read and memory corruption) or possibly     have unspecified other impact via an empty boolean     element in a wddxPacket XML document.(CVE-2016-9935)

  - In PHP before 5.6.31, an invalid free in the WDDX     deserialization of boolean parameters could be used by     attackers able to inject XML for deserialization to     crash the PHP interpreter, related to an invalid free     for an empty boolean element in     ext/wddx/wddx.c.(CVE-2017-11143)

  - Integer overflow in the php_html_entities function in     ext/standard/html.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact by     triggering a large output string from the     htmlspecialchars function.(CVE-2016-5094)

  - The get_icu_value_internal function in     ext/intl/locale/locale_methods.c in PHP before 5.5.36,     5.6.x before 5.6.22, and 7.x before 7.0.7 does not     ensure the presence of a '\0' character, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a crafted locale_get_primary_language     call.(CVE-2016-5093)

  - The grapheme_strpos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4541)

  - The exif_process_IFD_TAG function in ext/exif/exif.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 does not properly construct spprintf arguments,     which allows remote attackers to cause a denial of     service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4542)

  - The phar_parse_zipfile function in zip.c in the PHAR     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service     (out-of-bounds read and application crash) by placing a     PK\x05\x06 signature at an invalid     location.(CVE-2016-3142)

  - ** DISPUTED ** Integer overflow in the     php_raw_url_encode function in ext/standard/url.c in     PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before     7.0.5 allows remote attackers to cause a denial of     service (application crash) via a long string to the     rawurlencode function. NOTE: the vendor says 'Not sure     if this qualifies as security issue (probably     not).'(CVE-2016-4070)

  - The xml_parse_into_struct function in ext/xml/xml.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 allows remote attackers to cause a denial of     service (buffer under-read and segmentation fault) or     possibly have unspecified other impact via crafted XML     data in the second argument, leading to a parser level     of zero.(CVE-2016-4539)

  - The grapheme_stripos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4540)

  - Use-after-free vulnerability in wddx.c in the WDDX     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact by triggering a     wddx_deserialize call on XML data containing a crafted     var element.(CVE-2016-3141)

  - In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR     archive handler could be used by attackers supplying     malicious archive files to crash the PHP interpreter or     potentially disclose information due to a buffer     over-read in the phar_parse_pharfile function in     ext/phar/phar.c.(CVE-2017-11147)

  - The exif_process_IFD_in_JPEG function in     ext/exif/exif.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 does not validate IFD     sizes, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4543)

  - The odbc_bindcols function in ext/odbc/php_odbc.c in     PHP before 5.6.12 mishandles driver behavior for     SQL_WVARCHAR columns, which allows remote attackers to     cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table.(CVE-2015-8879)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write or read     occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not     handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression     containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in     next_state_val(), resulting in an out-of-bounds write     memory corruption.(CVE-2017-9226)

  - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x     before 7.1.7, the openssl extension PEM sealing code     did not check the return value of the OpenSSL sealing     function, which could lead to a crash of the PHP     interpreter, related to an interpretation conflict for     a negative number in ext/openssl/openssl.c, and an     OpenSSL documentation omission.(CVE-2017-11144)

  - The make_http_soap_request function in     ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before     5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service (type     confusion and application crash) via crafted serialized
    _cookies data, related to the SoapClient::__call method     in ext/soap/soap.c.(CVE-2016-3185)

  - The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data     call.(CVE-2016-10161)

  - The finish_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.6.31,     7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to     a buffer over-read while unserializing untrusted data.
    Exploitation of this issue can have an unspecified     impact on the integrity of PHP.(CVE-2017-12933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.12. It is, therefore, affected by multiple vulnerabilities :

 - A use-after-free error exists in file spl_dllist.c due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to deference freed memory and thus execute arbitrary code.

 - A use-after-free error exists in file spl_observer.c due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplObjectStorage object, to deference freed memory and thus execute arbitrary code.

 - A use-after-free error exists in file spl_array.c due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplArrayObject object, to deference freed memory and thus execute arbitrary code.

 - A flaw exists in file zend_exceptions.c due to the improper use of the function unserialize() during recursive method calls. A remote attacker can exploit this to crash an application using PHP.

 - A flaw exists in file zend_exceptions.c due to insufficient type checking by functions unserialize() and __toString(). A remote attacker can exploit this to cause a NULL pointer deference or unexpected method execution, thus causing an application using PHP to crash.

 - A path traversal flaw exists in file phar_object.c due to improper sanitization of user-supplied input. An attacker can exploit this to write arbitrary files.

 - Multiple type confusion flaws exist in the _call() method in file php_http.c when handling calls for zend_hash_get_current_key or 'Z*'. An attacker can exploit this to disclose memory contents or crash an application using PHP.

 - A dangling pointer error exists in file spl_array.c due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to gain control over a deallocated pointer and thus execute arbitrary code.

 - A flaw exists in the file gd.c due to the improper handling of images with large negative coordinates by the imagefilltoborder() function. An attacker can exploit this to cause a stack overflow, thus crashing an application using PHP.

 - A flaw exists in the file php_odbc.c when the odbc_fetch_array() function handles columns that are defined as NVARCHAR(MAX). An attacker can exploit this to crash an application using PHP.

 - The openssl_random_pseudo_bytes() function in file openssl.c does not generate sufficiently random numbers. This allows an attacker to more easily predict the results, thus allowing further attacks to be carried out.

 - A user-after-free error exists in the unserialize() function in spl_observer.c due to improper validation of user-supplied input. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code.

 - A type confusion flaw exists in the serialize_function_call() function in soap.c due to improper validation of input passed via the header field. A remote attacker can exploit this to execute arbitrary code.

 - A use-after-free error exists in the unserialize() function in spl_dllist.c that is triggered during the deserialization of user-supplied input. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code.

 - A user-after-free error exists in the gmp_unserialize() function in gmp.c due to improper validation of user-supplied input. A remote attacker can exploit this to dereference already freed memory, potentially resulting in the execution of arbitrary code.

 - An integer truncation flaw exists in the zend_hash_compare() function in zend_hash.c that is triggered when comparing arrays. A remote attacker can exploit this to cause arrays to be improperly matched during comparison.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403]

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

Bugfixes :

  - Compare with SQL_NULL_DATA correctly [bnc#935074]

  - If MD5 was disabled in net-snmp we have to disable the     used MD5 function in ext/snmp/snmp.c as well.
    (bsc#944302)

Also the Suhosin framework was updated to 0.9.38. [fate#319325]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

- CVE-2015-6831 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6832 Dangling pointer in the unserialization of     ArrayObject items.

  - CVE-2015-6833 Files extracted from archive may be placed     outside of destination directory

  - CVE-2015-6834 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6836 A type confusion occurs within SOAP     serialize_function_call due to an insufficient     validation of the headers field. In the SoapClient's
    __call method, the verify_soap_headers_array check is     applied only to headers retrieved from     zend_parse_parameters; problem is that a few lines     later, soap_headers could be updated or even replaced     with values from the __default_headers object fields.

  - CVE-2015-6837 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-6838 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-7803 A NULL pointer dereference flaw was found     in the way PHP's Phar extension parsed Phar archives. A     specially crafted archive could cause PHP to crash.

  - CVE-2015-7804 An uninitialized pointer use flaw was     found in the phar_make_dirstream() function of PHP's     Phar extension. A specially crafted phar file in the ZIP     format with a directory entry with a file name '/ZIP'     could cause a PHP application function to crash.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

It also includes a bugfix for the odbc module :

  - compare with SQL_NULL_DATA correctly [bnc#935074]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of PHP 5.6.x earlier than 5.6.12 are vulnerable to the following issues :

  - A flaw exists in the file 'gd.c' due to the improper handling of images with large negative coordinates by the imagefilltoborder() function. An attacker can exploit this to cause a stack overflow, thus crashing an application using PHP.
 - A flaw exists in the file 'php_odbc.c' when the odbc_fetch_array() function handles columns that are defined as NVARCHAR(MAX). An attacker can exploit this to crash an application using PHP.

Versions of PHP 5.4.x earlier than 5.4.44, 5.5.x earlier than 5.5.28, or 5.6.x earlier than 5.6.12 are vulnerable to the following issues :

  - A use-after-free error exists in file 'spl_dllist.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to deference freed memory and thus execute arbitrary code.
 - A use-after-free error exists in file 'spl_observer.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplObjectStorage object, to deference freed memory and thus execute arbitrary code.
 - A use-after-free error exists in file 'spl_array.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplArrayObject object, to deference freed memory and thus execute arbitrary code.
 - A flaw exists in file 'zend_exceptions.c' due to the improper use of the function unserialize() during recursive method calls. A remote attacker can exploit this to crash an application using PHP.
 - A flaw exists in file 'zend_exceptions.c' due to insufficient type checking by functions unserialize() and __toString(). A remote attacker can exploit this to cause a NULL pointer deference or unexpected method execution, thus causing an application using PHP to crash.
 - A path traversal flaw exists in file 'phar_object.c' due to improper sanitization of user-supplied input. An attacker can exploit this to write arbitrary files.
 - Multiple type confusion flaws exist in the _call() method in file 'php_http.c' when handling calls for zend_hash_get_current_key or 'Z*'. An attacker can exploit this to disclose memory contents or crash an application using PHP.
 - A dangling pointer error exists in file 'spl_array.c' due to improper sanitization of input to the unserialize() function. An attacker can exploit this, by using a specially crafted SplDoublyLinkedList object, to gain control over a deallocated pointer and thus execute arbitrary code.
 - The openssl_random_pseudo_bytes() function in file 'openssl.c' does not generate sufficiently random numbers. This allows an attacker to more easily predict the results, thus allowing further attacks to be carried out.
 - An integer truncation flaw exists in the zend_hash_compare() function in 'zend_hash.c' that is triggered when comparing arrays. A remote attacker can exploit this to cause arrays to be improperly matched during comparison.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2758-1 advisory.

    It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589)

    It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5590)

    Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

    Sean Heelan discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6832)

    It was discovered that the PHP phar extension incorrectly handled certain archives. A remote attacker     could use this issue to cause files to be placed outside of the destination directory. (CVE-2015-6833)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-6836)

    It was discovered that the PHP XSLTProcessor class incorrectly handled certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-6837)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PHP5 script interpreter was updated to fix various security issues :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403] 

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

Multiple vulnerabilities have been discovered in the PHP language :

  - CVE-2015-4598     thoger at redhat dot com discovered that paths     containing a NUL character were improperly handled, thus     allowing an attacker to manipulate unexpected files on     the server.

  - CVE-2015-4643     Max Spelsberg discovered an integer overflow flaw     leading to a heap-based buffer overflow in PHP's FTP     extension, when parsing listings in FTP server     responses. This could lead to a a crash or execution of     arbitrary code.

  - CVE-2015-4644     A denial of service through a crash could be caused by a     segfault in the php_pgsql_meta_data function.

  - CVE-2015-5589     kwrnel at hotmail dot com discovered that PHP could     crash when processing an invalid phar file, thus leading     to a denial of service.

  - CVE-2015-5590     jared at enhancesoft dot com discovered a buffer     overflow in the phar_fix_filepath function, that could     causes a crash or execution of arbitrary code.

  - Additionally, several other vulnerabilites were fixed :

    sean dot heelan at gmail dot com discovered a problem in     the unserialization of some items, that could lead to     arbitrary code execution.

  stewie at mail dot ru discovered that the phar extension improperly   handled zip archives with relative paths, which would allow an   attacker to overwrite files outside of the destination directory.

  taoguangchen at icloud dot com discovered several use-after-free   vulnerabilities that could lead to arbitrary code execution.

The PHP project reports :

Core :

- Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive method calls).

- Fixed bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref).

OpenSSL :

- Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure).

Phar :

- Improved fix for bug #69441.

- Fixed bug #70019 (Files extracted from archive may be placed outside of destination directory).

SOAP :

- Fixed bug #70081 (SoapClient info leak / NULL pointer dereference via multiple type confusions).

SPL :

- Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items).

- Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject).

- Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage).

- Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).

PHP process crashes when processing an invalid file with the 'phar' extension. (CVE-2015-5589)

As discussed upstream, mysqlnd is vulnerable to the attack described in https://www.duosecurity.com/blog/backronym-mysql-vulnerability.
(CVE-2015-3152)

PHP versions before 5.5.27 and 5.4.43 contain buffer overflow issue.
(CVE-2015-5590)

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6831 , CVE-2015-6832)

A flaw was found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. (CVE-2015-6833)

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.12. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in file spl_dllist.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplDoublyLinkedList object, to     deference freed memory and thus execute arbitrary code.

  - A use-after-free error exists in file spl_observer.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplObjectStorage object, to deference     freed memory and thus execute arbitrary code.

  - A use-after-free error exists in file spl_array.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplArrayObject object, to deference     freed memory and thus execute arbitrary code.

  - A flaw exists in file zend_exceptions.c due to the     improper use of the function unserialize() during     recursive method calls. A remote attacker can exploit     this to crash an application using PHP.

  - A flaw exists in file zend_exceptions.c due to     insufficient type checking by functions unserialize()     and __toString(). A remote attacker can exploit this to     cause a NULL pointer deference or unexpected method     execution, thus causing an application using PHP to     crash.

  - A path traversal flaw exists in file phar_object.c due     to improper sanitization of user-supplied input. An     attacker can exploit this to write arbitrary files.

  - Multiple type confusion flaws exist in the _call()     method in file php_http.c when handling calls for     zend_hash_get_current_key or 'Z*'. An attacker can     exploit this to disclose memory contents or crash     an application using PHP.

  - A dangling pointer error exists in file spl_array.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplDoublyLinkedList object, to gain     control over a deallocated pointer and thus execute     arbitrary code.

  - A flaw exists in the file gd.c due to the improper     handling of images with large negative coordinates by     the imagefilltoborder() function. An attacker can     exploit this to cause a stack overflow, thus crashing     an application using PHP.

  - A flaw exists in the file php_odbc.c when the     odbc_fetch_array() function handles columns that are     defined as NVARCHAR(MAX). An attacker can exploit this     to crash an application using PHP.

  - The openssl_random_pseudo_bytes() function in file     openssl.c does not generate sufficiently random numbers.
    This allows an attacker to more easily predict the     results, thus allowing further attacks to be carried     out.

  - A user-after-free error exists in the unserialize()     function in spl_observer.c due to improper validation     of user-supplied input. A remote attacker can exploit     this to dereference already freed memory, potentially     resulting in the execution of arbitrary code.

  - A type confusion flaw exists in the     serialize_function_call() function in soap.c due to     improper validation of input passed via the header     field. A remote attacker can exploit this to execute     arbitrary code.

  - A use-after-free error exists in the unserialize()     function in spl_dllist.c that is triggered during the     deserialization of user-supplied input. A remote     attacker can exploit this to dereference already freed     memory, potentially resulting in the execution of     arbitrary code.

  - A user-after-free error exists in the gmp_unserialize()     function in gmp.c due to improper validation of     user-supplied input. A remote attacker can exploit this     to dereference already freed memory, potentially     resulting in the execution of arbitrary code.

  - An integer truncation flaw exists in the     zend_hash_compare() function in zend_hash.c that is     triggered when comparing arrays. A remote attacker can     exploit this to cause arrays to be improperly matched     during comparison.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.28. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist in spl_array.c,     spl_observer.c, and spl_dllist.c due to improper     sanitization of input to the unserialize() function. An     attacker can exploit these issues, by using a specially     crafted SplDoublyLinkedList, SplArrayObject, or     SplObjectStorage object, to deference freed memory and     thus execute arbitrary code. (CVE-2015-6831)

  - A dangling pointer error exists in file spl_array.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplDoublyLinkedList object, to gain     control over a deallocated pointer and thus execute     arbitrary code. (CVE-2015-6832)

  - A path traversal flaw exists in file phar_object.c due     to improper sanitization of user-supplied input. An     attacker can exploit this to write arbitrary files.
    (CVE-2015-6833)

  - A type confusion flaw exists in the     serialize_function_call() function in soap.c due to     improper validation of input passed via the header     field. A remote attacker can exploit this to execute     arbitrary code. (CVE-2015-6836)

  - Multiple type confusion flaws exist in the _call()     method in file php_http.c when handling calls for     zend_hash_get_current_key or 'Z*'. An attacker can     exploit this to disclose memory contents or crash     an application using PHP. (CVE-2015-8835)

  - The openssl_random_pseudo_bytes() function in file     openssl.c does not generate sufficiently random numbers.
    This allows an attacker to more easily predict the     results, thus allowing further attacks to be carried     out. (CVE-2015-8867)

  - A flaw exists in file zend_exceptions.c due to the     improper use of the function unserialize() during     recursive method calls. A remote attacker can exploit     this to crash an application using PHP. (CVE-2015-8873)

  - A flaw exists in file zend_exceptions.c due to     insufficient type checking by functions unserialize()     and __toString(). A remote attacker can exploit this to     cause a NULL pointer deference or unexpected method     execution, thus causing an application using PHP to     crash. (CVE-2015-8876)

  - An integer truncation flaw exists in the     zend_hash_compare() function in zend_hash.c that is     triggered when comparing arrays. A remote attacker can     exploit this to cause arrays to be improperly matched     during comparison.
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.44. It is, therefore, affected by multiple vulnerabilities:

  - Multiple use-after-free vulnerabilities exist in the SPL     component, due to improper handling of a specially     crafted serialized object. An unauthenticated, remote     attack can exploit this, via vectors involving     ArrayObject, splObjectStorage and SplDoublyLinkedList to     execute arbitrary code. (CVE-2015-6831)

  - A use-after-free vulnerability exists in     ext/spl/spl_array.c due to improper handling of a     specially crafted serialized data. An unauthenticated,     remote attacker can exploit this via specially crafted     serialized data that triggers misuse of an array field     to execute arbitrary code. (CVE-2015-6832)

  - A directory traversal vulnerability exists in the     PharData class, due to improper implementation of the     exctractTo function. An unauthenticated, remote attacker     can exploit this via a crafted ZIP archive entry to     write to arbitrary files. (CVE-2015-6833)

  - The openssl_random_pseudo_bytes() function in file     openssl.c does not generate sufficiently random numbers.
    An unauthenticated, remote attacker can exploit this to     defeat cryptographic protection mechanisms.
    (CVE-2015-8867)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	critical
132184	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	Nessus	Huawei Local Security Checks	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	critical
130683	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)	Nessus	Huawei Local Security Checks	critical
98804	PHP 5.6.x < 5.6.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
119971	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1633-1)	Nessus	SuSE Local Security Checks	critical
93161	SUSE SLES11 Security Update : php53 (SUSE-SU-2016:1638-1) (BACKRONYM)	Nessus	SuSE Local Security Checks	critical
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
86794	Debian DLA-341-1 : php5 security update	Nessus	Debian Local Security Checks	critical
86616	SUSE SLES11 Security Update : php53 (SUSE-SU-2015:1818-1)	Nessus	SuSE Local Security Checks	high
8960	PHP 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
8959	PHP 5.4.x < 5.4.44 / 5.5.x < 5.5.28 / 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
86221	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2758-1)	Nessus	Ubuntu Local Security Checks	critical
86183	openSUSE Security Update : php5 (openSUSE-2015-609)	Nessus	SuSE Local Security Checks	critical
85664	Debian DSA-3344-1 : php5 - security update	Nessus	Debian Local Security Checks	critical
85484	FreeBSD : php5 -- multiple vulnerabilities (787ef75e-44da-11e5-93ad-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
85458	Amazon Linux AMI : php56 (ALAS-2015-585) (BACKRONYM)	Nessus	Amazon Linux Local Security Checks	critical
85457	Amazon Linux AMI : php55 (ALAS-2015-584) (BACKRONYM)	Nessus	Amazon Linux Local Security Checks	critical
85456	Amazon Linux AMI : php54 (ALAS-2015-583) (BACKRONYM)	Nessus	Amazon Linux Local Security Checks	critical
85300	PHP 5.6.x < 5.6.12 Multiple Vulnerabilities	Nessus	CGI abuses	high
85299	PHP 5.5.x < 5.5.28 Multiple Vulnerabilities	Nessus	CGI abuses	critical
85298	PHP 5.4.x < 5.4.44 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2015-6833

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

high

high

critical

critical

critical

high

critical

critical

critical

high

critical

high