The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of     service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.
    (CVE-2014-2270)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - The ELF parser in file 5.08 through 5.21 allows remote attackers to cause a denial of service via a large     number of notes. (CVE-2014-9620)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - file: Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

  - rpm: Following symlinks to files when installing packages allows privilege escalation (CVE-2017-7501)

  - It was found that rpm did not properly handle RPM installations when a destination path was a symbolic     link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files     being placed in an arbitrary destination. An attacker, with write access to a directory in which a     subdirectory will be installed, could redirect that directory to an arbitrary location and gain root     privilege. (CVE-2017-7500)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and     7.3.x below 7.3.6 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11040)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11042)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11041)

  - The openssl_random_pseudo_bytes function in     ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 incorrectly     relies on the deprecated RAND_pseudo_bytes function,     which makes it easier for remote attackers to defeat     cryptographic protection mechanisms via unspecified     vectors.(CVE-2015-8867)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-5590)

  - Use-after-free vulnerability in the wddx_stack_destroy     function in ext/wddx/wddx.c in PHP before 5.6.26 and     7.x before 7.0.11 allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a wddxPacket XML document that lacks an     end-tag for a recordset field element, leading to     mishandling in a wddx_deserialize call.(CVE-2016-7413)

  - The file_check_mem function in funcs.c in file before     5.23, as used in the Fileinfo component in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5,     mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of     service (buffer overflow and application crash) or     possibly execute arbitrary code via a crafted magic     file.(CVE-2015-8865)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 accepts a negative integer for the scale     argument, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted call.(CVE-2016-4537)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 modifies certain data structures without     considering whether they are copies of the _zero_,
    _one_, or _two_ global variable, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via a crafted     call.(CVE-2016-4538)

  - Integer overflow in the fread function in     ext/standard/file.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact     via a large integer in the second     argument.(CVE-2016-5096)

  - An out-of-bounds write flaw was found in the     fpm_log_write() logging function of PHP's FastCGI     Process Manager service. A remote attacker could     repeatedly send maliciously crafted requests to force     FPM to exhaust file system space, creating a denial of     service and preventing further logging.(CVE-2016-5114)

  - spl_array.c in the SPL extension in PHP before 5.5.37     and 5.6.x before 5.6.23 improperly interacts with the     unserialize implementation and garbage collection,     which allows remote attackers to execute arbitrary code     or cause a denial of service (use-after-free and     application crash) via crafted serialized     data.(CVE-2016-5771)

  - php_zip.c in the zip extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data containing a ZipArchive     object.(CVE-2016-5773)

  - Integer overflow in the virtual_file_ex function in     TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted extract operation on a ZIP     archive.(CVE-2016-6289)

  - When processing certain files, PHP EXIF extension in     versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated     buffer in exif_process_IFD_TAG function. This may lead     to information disclosure or crash.(CVE-2019-11034)

  - When processing certain files, PHP EXIF extension in     versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and     7.3.x below 7.3.4 can be caused to read past allocated     buffer in exif_iif_add_value function. This may lead to     information disclosure or crash.(CVE-2019-11035)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-5590)

  - Integer overflow in the virtual_file_ex function in     TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted extract operation on a ZIP     archive.(CVE-2016-6289)

  - php_zip.c in the zip extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data containing a ZipArchive     object.(CVE-2016-5773)

  - spl_array.c in the SPL extension in PHP before 5.5.37     and 5.6.x before 5.6.23 improperly interacts with the     unserialize implementation and garbage collection,     which allows remote attackers to execute arbitrary code     or cause a denial of service (use-after-free and     application crash) via crafted serialized     data.(CVE-2016-5771)

  - An out-of-bounds write flaw was found in the     fpm_log_write() logging function of PHP's FastCGI     Process Manager service. A remote attacker could     repeatedly send maliciously crafted requests to force     FPM to exhaust file system space, creating a denial of     service and preventing further logging.(CVE-2016-5114)

  - Integer overflow in the fread function in     ext/standard/file.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact     via a large integer in the second     argument.(CVE-2016-5096)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 modifies certain data structures without     considering whether they are copies of the _zero_,
    _one_, or _two_ global variable, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via a crafted     call.(CVE-2016-4538)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 accepts a negative integer for the scale     argument, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted call.(CVE-2016-4537)

  - The file_check_mem function in funcs.c in file before     5.23, as used in the Fileinfo component in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5,     mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of     service (buffer overflow and application crash) or     possibly execute arbitrary code via a crafted magic     file.(CVE-2015-8865)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and     7.3.x below 7.3.6 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11040)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11042)

  - When PHP EXIF extension is parsing EXIF information     from an image, e.g. via exif_read_data() function, in     PHP versions 7.1.x below 7.1.31, 7.2.x below 7.2.21 and     7.3.x below 7.3.8 it is possible to supply it with data     what will cause it to read past the allocated buffer.
    This may lead to information disclosure or     crash.(CVE-2019-11041)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An out-of-bounds write flaw was found in the     fpm_log_write() logging function of PHP's FastCGI     Process Manager service. A remote attacker could     repeatedly send maliciously crafted requests to force     FPM to exhaust file system space, creating a denial of     service and preventing further logging.(CVE-2016-5114)

  - spl_array.c in the SPL extension in PHP before 5.5.37     and 5.6.x before 5.6.23 improperly interacts with the     unserialize implementation and garbage collection,     which allows remote attackers to execute arbitrary code     or cause a denial of service (use-after-free and     application crash) via crafted serialized     data.(CVE-2016-5771)

  - php_zip.c in the zip extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data containing a ZipArchive     object.(CVE-2016-5773)

  - Integer overflow in the fread function in     ext/standard/file.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact     via a large integer in the second     argument.(CVE-2016-5096)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 accepts a negative integer for the scale     argument, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted call.(CVE-2016-4537)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 modifies certain data structures without     considering whether they are copies of the _zero_,
    _one_, or _two_ global variable, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via a crafted     call.(CVE-2016-4538)

  - The file_check_mem function in funcs.c in file before     5.23, as used in the Fileinfo component in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5,     mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of     service (buffer overflow and application crash) or     possibly execute arbitrary code via a crafted magic     file.(CVE-2015-8865)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-5590)

  - Use-after-free vulnerability in the wddx_stack_destroy     function in ext/wddx/wddx.c in PHP before 5.6.26 and     7.x before 7.0.11 allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a wddxPacket XML document that lacks an     end-tag for a recordset field element, leading to     mishandling in a wddx_deserialize call.(CVE-2016-7413)

  - Integer overflow in the phar_parse_pharfile function in     ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before     7.0.15 allows remote attackers to cause a denial of     service (memory consumption or application crash) via a     truncated manifest entry in a PHAR     archive.(CVE-2016-10159)

  - It was found that the exif_convert_any_to_int()     function in PHP was vulnerable to floating point     exceptions when parsing tags in image files. A remote     attacker with the ability to upload a malicious image     could crash PHP, causing a Denial of     Service.(CVE-2016-10158)

  - ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x     before 5.6.6, when PHP-FPM is used, does not isolate     each thread from libxml_disable_entity_loader changes     in other threads, which allows remote attackers to     conduct XML External Entity (XXE) and XML Entity     Expansion (XEE) attacks via a crafted XML document, a     related issue to CVE-2015-5161.(CVE-2015-8866)

  - Use-after-free vulnerability in the spl_ptr_heap_insert     function in ext/spl/spl_heap.c in PHP before 5.5.27 and     5.6.x before 5.6.11 allows remote attackers to execute     arbitrary code by triggering a failed     SplMinHeap::compare operation.(CVE-2015-4116)

  - Integer overflow in the virtual_file_ex function in     TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted extract operation on a ZIP     archive.(CVE-2016-6289)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The file_check_mem function in funcs.c in file before     5.23, as used in the Fileinfo component in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5,     mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of     service (buffer overflow and application crash) or     possibly execute arbitrary code via a crafted magic     file.(CVE-2015-8865)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 accepts a negative integer for the scale     argument, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via a crafted call.(CVE-2016-4537)

  - The bcpowmod function in ext/bcmath/bcmath.c in PHP     before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 modifies certain data structures without     considering whether they are copies of the _zero_,
    _one_, or _two_ global variable, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via a crafted     call.(CVE-2016-4538)

  - Integer overflow in the fread function in     ext/standard/file.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact     via a large integer in the second     argument.(CVE-2016-5096)

  - An out-of-bounds write flaw was found in the     fpm_log_write() logging function of PHP's FastCGI     Process Manager service. A remote attacker could     repeatedly send maliciously crafted requests to force     FPM to exhaust file system space, creating a denial of     service and preventing further logging.(CVE-2016-5114)

  - spl_array.c in the SPL extension in PHP before 5.5.37     and 5.6.x before 5.6.23 improperly interacts with the     unserialize implementation and garbage collection,     which allows remote attackers to execute arbitrary code     or cause a denial of service (use-after-free and     application crash) via crafted serialized     data.(CVE-2016-5771)

  - php_zip.c in the zip extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data containing a ZipArchive     object.(CVE-2016-5773)

  - Integer overflow in the virtual_file_ex function in     TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (stack-based     buffer overflow) or possibly have unspecified other     impact via a crafted extract operation on a ZIP     archive.(CVE-2016-6289)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-5590)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities :

 - A buffer over-write condition exists in the finfo_open() function due to improper validation of magic files. An unauthenticated, remote attacker can exploit this, via a crafted file, to cause a denial of service or to execute arbitrary code.

 - A flaw exists in the php_snmp_error() function within file ext/snmp/snmp.c that is triggered when handling format string specifiers. An unauthenticated, remote attacker can exploit this, via a crafted SNMP object, to cause a denial of service or to execute arbitrary code.

 - An invalid memory write error exists when handling the path of phar file names that allows an attacker to have an unspecified impact.

 - A flaw exists in the mbfl_strcut() function within file ext/mbstring/libmbfl/mbfl/mbfilter.c when handling negative parameter values. An unauthenticated, remote attacker can exploit this to cause a denial of service.

 - An integer overflow condition exists in the php_raw_url_encode() function within file ext/standard/url.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.20. It is, therefore, affected by multiple vulnerabilities :

 - A buffer over-write condition exists in the finfo_open() function due to improper validation of magic files. An unauthenticated, remote attacker can exploit this, via a crafted file, to cause a denial of service or to execute arbitrary code.

 - A flaw exists in the php_snmp_error() function within file ext/snmp/snmp.c that is triggered when handling format string specifiers. An unauthenticated, remote attacker can exploit this, via a crafted SNMP object, to cause a denial of service or to execute arbitrary code.

 - An invalid memory write error exists when handling the path of phar file names that allows an attacker to have an unspecified impact.

 - A flaw exists in the mbfl_strcut() function within file ext/mbstring/libmbfl/mbfl/mbfilter.c when handling negative parameter values. An unauthenticated, remote attacker can exploit this to cause a denial of service.

 - An integer overflow condition exists in the php_raw_url_encode() function within file ext/standard/url.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3686-1 advisory.

    Alexander Cherepanov discovered that file incorrectly handled a large number of notes. An attacker could     use this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9620)

    Alexander Cherepanov discovered that file incorrectly handled certain long strings. An attacker could use     this issue to cause a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-9621)

    Alexander Cherepanov discovered that file incorrectly handled certain malformed ELF files. An attacker     could use this issue to cause a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 14.04 LTS. (CVE-2014-9653)

    It was discovered that file incorrectly handled certain magic files. An attacker could use this issue with     a specially crafted magic file to cause a denial of service, or possibly execute arbitrary code. This     issue only affected Ubuntu 14.04 LTS. (CVE-2015-8865)

    It was discovered that file incorrectly handled certain malformed ELF files. An attacker could use this     issue to cause a denial of service. (CVE-2018-10360)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles continuation-level jumps, which allows context-dependent attackers to cause a denial of service (buffer overflow and application crash) or possibly execute arbitrary code via a crafted magic file. (CVE-2015-8865)

The remote host is affected by the vulnerability described in GLSA-201701-42 (file: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in file. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted input file, possibly resulting in execution of       arbitrary code with the privileges of the process, a Denial of Service       condition or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201611-22 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.5 and is affected by multiple vulnerabilities in the following components :

 - AMD
 - apache_mod_php
 - AppleGraphicsControl
 - AppleGraphicsPowerManagement
 - ATS
 - Audio
 - Captive Network Assistant
 - CFNetwork Proxies
 - CommonCrypto
 - CoreCapture
 - CoreStorage
 - Crash Reporter
 - Disk Images
 - Disk Utility
 - Graphics Drivers
 - ImageIO
 - Intel Graphics Driver
 - IOAcceleratorFamily
 - IOAudioFamily
 - IOFireWireFamily
 - IOHIDFamilyKernel
 - libc
 - libxml2
 - libxslt
 - MapKit
 - Messages
 - Multi-Touch
 - NVIDIA Graphics Drivers
 - OpenGL
 - QuickTime
 - SceneKit
 - Screen Lock
 - Tcl

- CVE-2015-8865 The file_check_mem function in funcs.c in     file before 5.23, as used in the Fileinfo component in     PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before     7.0.5, mishandles continuation-level jumps, which allows     context-dependent attackers to cause a denial of service     (buffer overflow and application crash) or possibly     execute arbitrary code via a crafted magic file.

  - CVE-2015-8866 libxml_disable_entity_loader setting is     shared between threads ext/libxml/libxml.c in PHP before     5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used,     does not isolate each thread from     libxml_disable_entity_loader changes in other threads,     which allows remote attackers to conduct XML External     Entity (XXE) and XML Entity Expansion (XEE) attacks via     a crafted XML document, a related issue to     CVE-2015-5161.

  - CVE-2015-8878 main/php_open_temporary_file.c in PHP     before 5.5.28 and 5.6.x before 5.6.12 does not ensure     thread safety, which allows remote attackers to cause a     denial of service (race condition and heap memory     corruption) by leveraging an application that performs     many temporary-file accesses.

  - CVE-2015-8879 The odbc_bindcols function in     ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles     driver behavior for SQL_WVARCHAR columns, which allows     remote attackers to cause a denial of service     (application crash) in opportunistic circumstances by     leveraging use of the odbc_fetch_array function to     access a certain type of Microsoft SQL Server table.

  - CVE-2016-4070 Integer overflow in the php_raw_url_encode     function in ext/standard/url.c in PHP before 5.5.34,     5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote     attackers to cause a denial of service (application     crash) via a long string to the rawurlencode function.

  - CVE-2016-4071 Format string vulnerability in the     php_snmp_error function in ext/snmp/snmp.c in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows     remote attackers to execute arbitrary code via format     string specifiers in an SNMP::get call.

  - CVE-2016-4072 The Phar extension in PHP before 5.5.34,     5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote     attackers to execute arbitrary code via a crafted     filename, as demonstrated by mishandling of \0     characters by the phar_analyze_path function in     ext/phar/phar.c.

  - CVE-2016-4073 Multiple integer overflows in the     mbfl_strcut function in     ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before     5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow     remote attackers to cause a denial of service     (application crash) or possibly execute arbitrary code     via a crafted mb_strcut call.

  - CVE-2016-4343 The phar_make_dirstream function in     ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before     7.0.3 mishandles zero-size ././@LongLink files, which     allows remote attackers to cause a denial of service     (uninitialized pointer dereference) or possibly have     unspecified other impact via a crafted TAR archive.

  - CVE-2016-4537 The bcpowmod function in     ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 accepts a negative integer     for the scale argument, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a crafted call.

  - CVE-2016-4539 The xml_parse_into_struct function in     ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21,     and 7.x before 7.0.6 allows remote attackers to cause a     denial of service (buffer under-read and segmentation     fault) or possibly have unspecified other impact via     crafted XML data in the second argument, leading to a     parser level of zero.

  - CVE-2016-4540

  - CVE-2016-4541 The grapheme_strpos function in     ext/intl/grapheme/grapheme_string.c in before 5.5.35,     5.6.x before 5.6.21, and 7.x before 7.0.6 allows remote     attackers to cause a denial of service (out-of-bounds     read) or possibly have unspecified other impact via a     negative offset.

  - CVE-2016-4542

  - CVE-2016-4543

  - CVE-2016-4544 The exif_process_* function in     ext/exif/exif.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 does not validate IFD     sizes, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via crafted header data.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2984-1 advisory.

    It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8865)

    Hans Jerry Illikainen discovered that the PHP Zip extension incorrectly handled certain malformed Zip     archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3078)

    It was discovered that PHP incorrectly handled invalid indexes in the SplDoublyLinkedList class. An     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3132)

    It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. This issue only     affected Ubuntu 16.04 LTS. (CVE-2016-4070)

    It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4071)

    It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4072)

    It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-4073)

    It was discovered that the PHP phar extension incorrectly handled certain archive files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 15.10.
    (CVE-2016-4342, CVE-2016-4343)

    It was discovered that the PHP bcpowmod() function incorrectly handled memory. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.

    (CVE-2016-4537, CVE-2016-4538)

    It was discovered that the PHP XML parser incorrectly handled certain malformed XML data. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4539)

    It was discovered that certain PHP grapheme functions incorrectly handled negative offsets. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
    (CVE-2016-4540, CVE-2016-4541)

    It was discovered that PHP incorrectly handled certain malformed EXIF tags. A remote attacker could     possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-4542,     CVE-2016-4543, CVE-2016-4544)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A malformed magic file could trigger a segmentation fault and thus crash applications due to a buffer over-write in the file_check_mem function.

For Debian 7 'Wheezy', this problem has been fixed in version 5.11-2+deb7u9.

We recommend that you upgrade your file packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following security-related issues were resolved :

Buffer over-write in finfo_open with malformed magic file (CVE-2015-8865)

Signedness vulnerability causing heap overflow in libgd (CVE-2016-3074)

Integer overflow in php_raw_url_encode (CVE-2016-4070)

Format string vulnerability in php_snmp_error() (CVE-2016-4071)

Invalid memory write in phar on filename containing \\0 inside name (CVE-2016-4072)

Negative size parameter in memcpy (CVE-2016-4073)

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.20, which includes additional bug fixes. Please refer to the upstream changelog for more information :

  - https://php.net/ChangeLog-5.php#5.6.20

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.5. It is, therefore, affected by multiple vulnerabilities :

  - A buffer over-write condition exists in the finfo_open()     function due to improper validation of magic files. An     unauthenticated, remote attacker can exploit this, via a     crafted file, to cause a denial of service or to execute     arbitrary code.

  - A flaw exists in the php_snmp_error() function within     file ext/snmp/snmp.c that is triggered when handling     format string specifiers. An unauthenticated, remote     attacker can exploit this, via a crafted SNMP object,     to cause a denial of service or to execute arbitrary     code.

  - An invalid memory write error exists when handling     the path of phar file names that allows an attacker     to have an unspecified impact.

  - A flaw exists in the mbfl_strcut() function within file     ext/mbstring/libmbfl/mbfl/mbfilter.c when handling     negative parameter values. An unauthenticated, remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in the     php_raw_url_encode() function within file     ext/standard/url.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.20. It is, therefore, affected by multiple vulnerabilities :

  - A buffer over-write condition exists in the finfo_open()     function due to improper validation of magic files. An     unauthenticated, remote attacker can exploit this, via a     crafted file, to cause a denial of service or to execute     arbitrary code.

  - A flaw exists in the php_snmp_error() function within     file ext/snmp/snmp.c that is triggered when handling     format string specifiers. An unauthenticated, remote     attacker can exploit this, via a crafted SNMP object,     to cause a denial of service or to execute arbitrary     code.

  - An invalid memory write error exists when handling     the path of phar file names that allows an attacker     to have an unspecified impact.

  - A flaw exists in the mbfl_strcut() function within file     ext/mbstring/libmbfl/mbfl/mbfilter.c when handling     negative parameter values. An unauthenticated, remote     attacker can exploit this to cause a denial of service.

  - An integer overflow condition exists in the     php_raw_url_encode() function within file     ext/standard/url.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.34. It is, therefore, affected by multiple vulnerabilities :

  - A buffer over-write condition exists in the finfo_open()     function due to improper validation of magic files. An     unauthenticated, remote attacker can exploit this, via a     crafted file, to cause a denial of service or to execute     arbitrary code. (CVE-2015-8865)

  - An integer overflow condition exists in the     php_raw_url_encode() function within file     ext/standard/url.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.
    (CVE-2016-4070)     
  - A flaw exists in the php_snmp_error() function within     file ext/snmp/snmp.c that is triggered when handling     format string specifiers. An unauthenticated, remote     attacker can exploit this, via a crafted SNMP object,     to cause a denial of service or to execute arbitrary     code. (CVE-2016-4071)

  - An invalid memory write error exists when handling     the path of phar file names that allows an attacker     to have an unspecified impact. (CVE-2016-4072)

  - A flaw exists in the mbfl_strcut() function within file     ext/mbstring/libmbfl/mbfl/mbfilter.c when handling     negative parameter values. An unauthenticated, remote     attacker can exploit this to cause a denial of service.
    (CVE-2016-4073)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198569	RHEL 5 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198479	RHEL 7 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198468	RHEL 6 : rpm (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
129236	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2043)	Nessus	Huawei Local Security Checks	critical
128931	EulerOS Virtualization for ARM 64 3.0.2.0 : php (EulerOS-SA-2019-1928)	Nessus	Huawei Local Security Checks	critical
128917	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-1865)	Nessus	Huawei Local Security Checks	critical
128087	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1795)	Nessus	Huawei Local Security Checks	critical
98851	PHP 7.0.x < 7.0.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98810	PHP 5.6.x < 5.6.20 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
110552	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : file vulnerabilities (USN-3686-1)	Nessus	Ubuntu Local Security Checks	high
97447	F5 Networks BIG-IP : PHP vulnerability (K54924436)	Nessus	F5 Networks Local Security Checks	high
96576	GLSA-201701-42 : file: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
95421	GLSA-201611-22 : PHP: Multiple vulnerabilities (httpoxy)	Nessus	Gentoo Local Security Checks	critical
9392	Mac OS X 10.11.x < 10.11.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
91397	Debian DLA-499-1 : php5 security update	Nessus	Debian Local Security Checks	critical
91320	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-2984-1)	Nessus	Ubuntu Local Security Checks	critical
90944	Debian DLA-460-1 : file security update	Nessus	Debian Local Security Checks	high
90867	Amazon Linux AMI : php56 / php55 (ALAS-2016-698)	Nessus	Amazon Linux Local Security Checks	critical
90768	Debian DSA-3560-1 : php5 - security update	Nessus	Debian Local Security Checks	critical
90362	PHP 7.0.x < 7.0.5 Multiple Vulnerabilities	Nessus	CGI abuses	critical
90361	PHP 5.6.x < 5.6.20 Multiple Vulnerabilities	Nessus	CGI abuses	critical
90360	PHP 5.5.x < 5.5.34 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2015-8865

high

Tenable Plugins

high

high

high

critical

critical

critical

critical

critical

critical

high

high

high

critical

high

critical

critical

high

critical

critical

critical

critical

critical