Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execute arbitrary code via vectors related to (1) the Serializable interface, (2) the SplObjectStorage class, and (3) the SplDoublyLinkedList class, which are mishandled during unserialization.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2014-8142)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4026)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6834)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-4025)

  - An integer overflow flaw was found in the way custom     objects were unserialized. Specially crafted input     processed by the unserialize() function could cause a     PHP application to crash.(CVE-2014-3669)

  - It was found that PHP move_uploaded_file() function did     not properly handle file names with a NULL character. A     remote attacker could possibly use this flaw to make a     PHP script access unexpected files and bypass intended     file system access restrictions.(CVE-2015-2348)

  - An integer overflow flaw leading to a heap-based buffer     overflow was found in the way PHP's FTP extension     parsed file listing FTP server responses. A malicious     FTP server could use this flaw to cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4022)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6836)

  - A NULL pointer dereference flaw was found in the     XSLTProcessor class in PHP. An attacker could use this     flaw to cause a PHP application to crash if it     performed Extensible Stylesheet Language (XSL)     transformations using untrusted XSLT files and allowed     the use of PHP functions to be used as XSLT functions     within XSL stylesheets.(CVE-2015-6837)

  - It was found that PHP's gd extension did not properly     handle file names with a null character. A remote     attacker could possibly use this flaw to make a PHP     application access unexpected files and bypass intended     file system access restrictions.(CVE-2014-5120)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6835)

  - Stack consumption vulnerability in     Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 allows remote     attackers to cause a denial of service (segmentation     fault) via recursive method calls.(CVE-2015-8873)

  - An uninitialized pointer use flaw was found in PHP's     Exif extension. A specially crafted JPEG or TIFF file     could cause a PHP application using the     exif_read_data() function to crash or, possibly,     execute arbitrary code with the privileges of the user     running that PHP application.(CVE-2015-0232)

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-2787)

  - A buffer over-read flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2783)

  - A use-after-free flaw was found in the unserialize()     function of PHP's DateTimeZone implementation. A     malicious script author could possibly use this flaw to     disclose certain portions of server     memory.(CVE-2015-0273)

  - Multiple buffer over-read flaws were found in the     php_parserr() function of PHP. A malicious DNS server     or a man-in-the-middle attacker could possibly use this     flaw to crash a PHP application that used the     dns_get_record() function to perform a DNS     query.(CVE-2014-3597)

  - A buffer overflow flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3329)

  - Integer overflow in the ftp_genlist function in     ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before     5.5.26, and 5.6.x before 5.6.10 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2015-4022.(CVE-2015-4643)

  - A type confusion issue was found in PHP's phpinfo()     function. A malicious script author could possibly use     this flaw to disclose certain portions of server     memory.(CVE-2014-4721)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.13. It is, therefore, affected by multiple vulnerabilities :

 - Multiple use-after-free memory errors exist related to the unserialize() function, which a remote attacker can exploit to execute arbitrary code. (CVE-2015-6834)

 - A use-after-free memory error exists related to the php_var_unserialize() function. A remote attacker, using a crafted serialize string, can exploit this to execute arbitrary code. (CVE-2015-6835)

 - A type confusion error exists related to the serialize_function_call() function due to improper validation of the headers field, which a remote attacker can exploit to have unspecified impact. (CVE-2015-6836)

 - A flaw exists in the XSLTProcessor class due to improper validation of input from the libxslt library, which a remote attacker can exploit to have an unspecified impact. (CVE-2015-6837, CVE-2015-6838)

 - A flaw exists in the php_zip_extract_file() function in file php_zip.c due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to create arbitrary directories outside of the restricted path.

 - A NULL pointer dereference flaw exists in the spl_autoload() function in file php_spl.c due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a PHP application to crash.

 - A flaw exists in the parse_ini_file() and parse_ini_string() functions due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a PHP application to crash.

 - A flaw exists in the CLI SAPI Web Server due to improper sanitization of user-supplied input. An unauthenticated, remote attacker can exploit this to access arbitrary files outside of the restricted path.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of PHP5 brings several security fixes.

Security fixes :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403]

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

Bugfixes :

  - Compare with SQL_NULL_DATA correctly [bnc#935074]

  - If MD5 was disabled in net-snmp we have to disable the     used MD5 function in ext/snmp/snmp.c as well.
    (bsc#944302)

Also the Suhosin framework was updated to 0.9.38. [fate#319325]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201606-10 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

Use after free vulnerability was found in unserialize() function. We can create ZVAL and free it via Serializable::unserialize. However the unserialize() will still allow to use R: or r: to set references to that already freed memory. It is possible to use-after-free attack and execute arbitrary code remotely.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.1 and is affected by multiple vulnerabilities in the following components :

 - Accelerate Framework (CVE-2015-5940)
 - apache_mod_php (CVE-2015-0235, CVE-2015-0273, CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838)
 - ATS (CVE-2015-6985)
 - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)
 - Bom (CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Directory Utility (CVE-2015-6980)
 - Disk Images (CVE-2015-6995)
 - EFI (CVE-2015-7035)
 - File Bookmark (CVE-2015-6987)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Drivers (CVE-2015-7019, CVE-2015-7020, CVE-2015-7021)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5938, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)
 - libarchive (CVE-2015-6984)
 - MCX Application Restrictions (CVE-2015-7016)
 - Net-SNMP (CVE-2014-3565, CVE-2012-6151)
 - OpenGL (CVE-2015-5924)
 - OpenSSH (CVE-2015-6563)
 - Sandbox (CVE-2015-5945)
 - Script Editor (CVE-2015-7007)
 - Security (CVE-2015-6983, CVE-2015-7024)
 - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

The remote host is running a version of Mac OS X 10.9.5 or 10.10.5 that is missing Security Update 2015-004 or 2015-007. It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework
  - apache_mod_php
  - ATS
  - Audio
  - CFNetwork
  - CoreGraphics
  - CoreText
  - EFI
  - FontParser
  - Grand Central Dispatch
  - ImageIO
  - IOAcceleratorFamily
  - Kernel
  - libarchive
  - MCX Application Restrictions
  - OpenGL

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

- CVE-2015-6831 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6832 Dangling pointer in the unserialization of     ArrayObject items.

  - CVE-2015-6833 Files extracted from archive may be placed     outside of destination directory

  - CVE-2015-6834 Use after free vulnerability was found in     unserialize() function. We can create ZVAL and free it     via Serializable::unserialize. However the unserialize()     will still allow to use R: or r: to set references to     that already freed memory. It is possible to     use-after-free attack and execute arbitrary code     remotely.

  - CVE-2015-6836 A type confusion occurs within SOAP     serialize_function_call due to an insufficient     validation of the headers field. In the SoapClient's
    __call method, the verify_soap_headers_array check is     applied only to headers retrieved from     zend_parse_parameters; problem is that a few lines     later, soap_headers could be updated or even replaced     with values from the __default_headers object fields.

  - CVE-2015-6837 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-6838 The XSLTProcessor class misses a few     checks on the input from the libxslt library. The     valuePop() function call is able to return NULL pointer     and php does not check that.

  - CVE-2015-7803 A NULL pointer dereference flaw was found     in the way PHP's Phar extension parsed Phar archives. A     specially crafted archive could cause PHP to crash.

  - CVE-2015-7804 An uninitialized pointer use flaw was     found in the phar_make_dirstream() function of PHP's     Phar extension. A specially crafted phar file in the ZIP     format with a directory entry with a file name '/ZIP'     could cause a PHP application function to crash.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is 10.9.5 or later but prior to 10.11.1 It is, therefore, affected by multiple vulnerabilities in the following components :

  - Accelerate Framework (CVE-2015-5940)

  - apache_mod_php (CVE-2015-0235, CVE-2015-0273,     CVE-2015-6834, CVE-2015-6835, CVE-2015-6836,     CVE-2015-6837, CVE-2015-6838)

  - ATS (CVE-2015-6985)

  - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)

  - Bom (CVE-2015-7006)

  - CFNetwork (CVE-2015-7023)

  - configd (CVE-2015-7015)

  - CoreGraphics (CVE-2015-5925, CVE-2015-5926)

  - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992,     CVE-2015-7017)

  - Directory Utility (CVE-2015-6980)

  - Disk Images (CVE-2015-6995)

  - EFI (CVE-2015-7035)

  - File Bookmark (CVE-2015-6987)

  - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976,     CVE-2015-6977, CVE-2015-6978, CVE-2015-6990,     CVE-2015-6991, CVE-2015-6993, CVE-2015-7008,     CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)

  - Grand Central Dispatch (CVE-2015-6989)

  - Graphics Drivers (CVE-2015-7019, CVE-2015-7020,     CVE-2015-7021)

  - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937,     CVE-2015-5938, CVE-2015-5939)

  - IOAcceleratorFamily (CVE-2015-6996)

  - IOHIDFamily (CVE-2015-6974)

  - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)

  - libarchive (CVE-2015-6984)

  - MCX Application Restrictions (CVE-2015-7016)

  - Net-SNMP (CVE-2014-3565, CVE-2012-6151)

  - OpenGL (CVE-2015-5924)

  - OpenSSH (CVE-2015-6563)

  - Sandbox (CVE-2015-5945)

  - Script Editor (CVE-2015-7007)

  - Security (CVE-2015-6983, CVE-2015-7024)

  - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

As reported upstream, A NULL pointer dereference flaw was found in the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash. (CVE-2015-7803 )

A flaw was discovered in the way PHP performed object unserialization.
Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-6834 , CVE-2015-6835 , CVE-2015-6836)

A NULL pointer dereference flaw was found in the XSLTProcessor class in PHP. An attacker could use this flaw to cause a PHP application to crash if it performed Extensible Stylesheet Language (XSL) transformations using untrusted XSLT files and allowed the use of PHP functions to be used as XSLT functions within XSL stylesheets.
(CVE-2015-6837 , CVE-2015-6838)

As reported upstream, an uninitialized pointer use flaw was found in the phar_make_dirstream() function of PHP's Phar extension. A specially crafted phar file in the ZIP format with a directory entry with a file name '/ZIP' could cause a PHP application function to crash. (CVE-2015-7804)

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2758-1 advisory.

    It was discovered that the PHP phar extension incorrectly handled certain files. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-5589)

    It was discovered that the PHP phar extension incorrectly handled certain filepaths. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-5590)

    Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6831, CVE-2015-6834, CVE-2015-6835

    Sean Heelan discovered that PHP incorrectly handled unserializing objects. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-6832)

    It was discovered that the PHP phar extension incorrectly handled certain archives. A remote attacker     could use this issue to cause files to be placed outside of the destination directory. (CVE-2015-6833)

    Andrea Palazzo discovered that the PHP Soap client incorrectly validated data types. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-6836)

    It was discovered that the PHP XSLTProcessor class incorrectly handled certain data. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2015-6837)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PHP5 script interpreter was updated to fix various security issues :

  - CVE-2015-6831: A use after free vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#942291]     [bnc#942294] [bnc#942295]

  - CVE-2015-6832: A dangling pointer in the unserialization     of ArrayObject items could be used to crash php or     potentially execute code. [bnc#942293]

  - CVE-2015-6833: A directory traversal when extracting ZIP     files could be used to overwrite files outside of     intended area. [bnc#942296]

  - CVE-2015-6834: A Use After Free Vulnerability in     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945403] 

  - CVE-2015-6835: A Use After Free Vulnerability in session     unserialize() has been fixed which could be used to     crash php or potentially execute code. [bnc#945402]

  - CVE-2015-6836: A SOAP serialize_function_call() type     confusion leading to remote code execution problem was     fixed. [bnc#945428]

  - CVE-2015-6837 CVE-2015-6838: Two NULL pointer     dereferences in the XSLTProcessor class were fixed.
    [bnc#945412]

03 Sep 2015, **PHP 5.6.13** **Core:** * Fixed bug #69900 (Too long timeout on pipes). (Anatol) * Fixed bug #69487 (SAPI may truncate POST data). (cmb) * Fixed bug #70198 (Checking liveness does not work as expected). (Shafreeck Sea, Anatol Belski) * Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas) * Fixed bug #70219 (Use after free vulnerability in session deserializer). (taoguangchen at icloud dot com) **CLI server:** * Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE). (wusuopu, cmb) * Fixed bug #70264 (CLI server directory traversal). (cmb) **Date:** * Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional). (cmb)

  - Fixed bug #70277 (new DateTimeZone($foo) is ignoring     text after null byte). (cmb) **EXIF:** * Fixed bug     #70385 (Buffer over-read in exif_read_data with TIFF IFD     tag byte value of 32 bytes). (Stas) **hash:** * Fixed     bug #70312 (HAVAL gives wrong hashes in specific cases).
    (letsgolee at naver dot com) **MCrypt:** * Fixed bug     #69833 (mcrypt fd caching not working). (Anatol)
    **Opcache:** * Fixed bug #70237 (Empty while and     do-while segmentation fault with opcode on CLI enabled).
    (Dmitry, Laruence) **PCRE:** * Fixed bug #70232     (Incorrect bump-along behavior with \K and empty string     match). (cmb) * Fixed bug #70345 (Multiple     vulnerabilities related to PCRE functions). (Anatol     Belski) **SOAP:** * Fixed bug #70388 (SOAP     serialize_function_call() type confusion / RCE). (Stas)
    **SPL:** * Fixed bug #70290 (NULL pointer deref     (segfault) in spl_autoload via ob_start). (hugh at     allthethings dot co dot nz) * Fixed bug #70303     (Incorrect constructor reflection for ArrayObject).
    (cmb) * Fixed bug #70365 (Use-after-free vulnerability     in unserialize() with SplObjectStorage). (taoguangchen     at icloud dot com) * Fixed bug #70366 (Use-after-free     vulnerability in unserialize() with     SplDoublyLinkedList). (taoguangchen at icloud dot com)
    **Standard:** * Fixed bug #70052 (getimagesize() fails     for very large and very small WBMP). (cmb) * Fixed bug     #70157 (parse_ini_string() segmentation fault with     INI_SCANNER_TYPED). (Tjerk) **XSLT:** * Fixed bug #69782     (NULL pointer dereference). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of PHP 5.4.x prior to 5.4.45, 5.5.x prior to 5.5.29, or 5.6.x prior to 5.6.13 are vulnerable to the following issues :

  - A use-after-free error exists in the unserialize() function in 'ext/spl/spl_observer.c'. The issue is triggered as user-supplied input is not sanitized. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw affects the serialize_function_call() function in 'ext/soap/soap.c'. The issue is triggered when handling input passed via the header field. This may allow a remote attacker to execute arbitrary code.
 - A use-after-free error affects the object_custom() function in 'ext/standard/var_unserializer.c'. The issue is triggered when handling user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error affects the unserialize() function in 'ext/spl/spl_dllist.c'. The issue is triggered during the deserialization of user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw in the exif_process_IFD_TAG() function in 'ext/exif/exif.c' that is triggered when handling TIFF IFD tags. This may allow a context-dependent attacker to crash an application linked against PHP or potentially disclose memory contents.
 - An overflow condition exists in the php_pcre_match_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the php_pcre_split_impl() function in 'ext/pcre/php_pcre.c'. The flaw is triggered during the handling of offsets that consist of a start and end position within the subject string, which can cause an exhaustion of memory resources. This may allow a remote attacker to exhaust available memory.
 - An overflow condition affects the php_pcre_replace_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated when handling offsets. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the php_var_unserialize() function of the session deserializer (php_binary/php_serialize). The issue is triggered when deserializing multiple forms of data. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A NULL pointer dereference flaw exists in the xsl_ext_function_php() function in 'ext/xsl/xsltprocessor.c' that is triggered as checks are not properly performed on user-supplied input. This may allow a remote attacker to cause a denial of service.
 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the php_zip_extract_file() function in 'ext/zip/php_zip.c' not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') passed to the ZipArchive::extractTo() method. This may allow a remote attacker to create arbitrary directories.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to new upstream versions (5.4.45 and 5.6.13), which include additional bug fixes.
Please refer to the upstream changelog for more information :

  - https://php.net/ChangeLog-5.php#5.4.45
  - https://php.net/ChangeLog-5.php#5.6.13

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.13. It is, therefore, affected by multiple vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function, which a remote attacker can     exploit to execute arbitrary code. (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field, which a remote attacker     can exploit to have unspecified impact. (CVE-2015-6836)

  - A flaw exists in the XSLTProcessor class due to     improper validation of input from the libxslt library,     which a remote attacker can exploit to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

  - A NULL pointer dereference flaw exists in the     spl_autoload() function in file php_spl.c due to     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a PHP application to crash.

  - A flaw exists in the parse_ini_file() and     parse_ini_string() functions due to improper     sanitization of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a PHP     application to crash.

  - A flaw exists in the CLI SAPI Web Server due to improper     sanitization of user-supplied input. An unauthenticated,     remote attacker can exploit this to access arbitrary     files outside of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.29. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.4.x prior to 5.4.45. It is, therefore, affected by the following vulnerabilities :

  - A directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c     could allow a remote attacker to create arbitrary     empty directories via a crafted ZIP archive.
    (CVE-2014-9767)

  - Multiple use-after-free memory errors exist related to     the unserialize() function. A remote attacker can     exploit these errors to execute arbitrary code.
    (CVE-2015-6834)

  - A use-after-free memory error exists related to the     php_var_unserialize() function. A remote attacker, using     a crafted serialize string, can exploit this to execute     arbitrary code. (CVE-2015-6835)

  - A type confusion error exists related to the     serialize_function_call() function due to improper     validation of the headers field. A remote attacker can     exploit this to have unspecified impact. (CVE-2015-6836)

  - Multiple flaws exist in the XSLTProcessor class due to     improper validation of input from the libxslt library. A     remote attacker can exploit thse flaws to have an     unspecified impact. (CVE-2015-6837, CVE-2015-6838)

  - A flaw exists in the php_zip_extract_file() function     in file php_zip.c due to improper sanitization of     user-supplied input. An unauthenticated, remote attacker     can exploit this to create arbitrary directories outside     of the restricted path.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

PHP reports :

- Core :

- Fixed bug #70172 (Use After Free Vulnerability in unserialize()).

- Fixed bug #70219 (Use after free vulnerability in session deserializer).

- EXIF :

- Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte value of 32 bytes).

- hash :

- Fixed bug #70312 (HAVAL gives wrong hashes in specific cases).

- PCRE :

- Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).

- SOAP :

- Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).

- SPL :

- Fixed bug #70365 (Use-after-free vulnerability in unserialize() with SplObjectStorage).

- Fixed bug #70366 (Use-after-free vulnerability in unserialize() with SplDoublyLinkedList).

- XSLT :

- Fixed bug #69782 (NULL pointer dereference).

- ZIP :

- Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories).

ID	Name	Product	Family	Severity
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
124996	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1543)	Nessus	Huawei Local Security Checks	critical
98805	PHP 5.6.x < 5.6.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
119971	SUSE SLES12 Security Update : php5 (SUSE-SU-2015:1633-1)	Nessus	SuSE Local Security Checks	critical
91704	GLSA-201606-10 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91433	F5 Networks BIG-IP : PHP vulnerabilities (SOL17377)	Nessus	F5 Networks Local Security Checks	critical
9324	Mac OS X 10.9.5 or later < 10.11.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
89967	Amazon Linux AMI : php54 (ALAS-2016-670)	Nessus	Amazon Linux Local Security Checks	critical
86829	Mac OS X Multiple Vulnerabilities (Security Updates 2015-004 / 2015-007)	Nessus	MacOS X Local Security Checks	critical
86794	Debian DLA-341-1 : php5 security update	Nessus	Debian Local Security Checks	critical
86654	Mac OS X < 10.11.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
86496	Amazon Linux AMI : php55 (ALAS-2015-602)	Nessus	Amazon Linux Local Security Checks	critical
86495	Amazon Linux AMI : php56 (ALAS-2015-601)	Nessus	Amazon Linux Local Security Checks	critical
86223	Slackware 14.0 / 14.1 / current : php (SSA:2015-274-02)	Nessus	Slackware Local Security Checks	critical
86221	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2758-1)	Nessus	Ubuntu Local Security Checks	critical
86183	openSUSE Security Update : php5 (openSUSE-2015-609)	Nessus	SuSE Local Security Checks	critical
86030	Fedora 23 : php-5.6.13-1.fc23 (2015-14978)	Nessus	Fedora Local Security Checks	critical
85934	Fedora 22 : php-5.6.13-1.fc22 (2015-14977)	Nessus	Fedora Local Security Checks	critical
85933	Fedora 21 : php-5.6.13-1.fc21 (2015-14976)	Nessus	Fedora Local Security Checks	critical
8861	PHP 5.4.x < 5.4.45 / 5.5.x < 5.5.29 / 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical
85914	Debian DSA-3358-1 : php5 - security update	Nessus	Debian Local Security Checks	critical
85887	PHP 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus	CGI abuses	high
85886	PHP 5.5.x < 5.5.29 Multiple Vulnerabilities	Nessus	CGI abuses	high
85885	PHP 5.4.x < 5.4.45 Multiple Vulnerabilities	Nessus	CGI abuses	high
85859	FreeBSD : php -- multiple vulnerabilities (3d675519-5654-11e5-9ad8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2015-6834

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

high

high

critical