The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a large bgd_color argument to the imagerotate function.

According to its banner, the version of PHP running on the remote host is 5.6.x prior to 5.6.17. It is, therefore, affected by multiple vulnerabilities :

 - An out-of-bounds read error exists in the gdImageRotateInterpolated() function in file gd_interpolation.c when handling background colors. A remote attacker can exploit this to disclose memory contents or crash the application. (CVE-2016-1903)

 - An unspecified flaw exists in file fpm_log.c in the fpm_log_write() function when handling very long HTTP requests. A local attacker can exploit this to obtain sensitive information, via access to the access log file. (CVE-2016-5114)

 - A use-after-free error exists in file wddx.c in the php_wddx_pop_element() function when handling WDDX packet deserialization. A remote attacker can exploit this, by dereferencing already freed memory, to execute arbitrary code.

 - A type confusion flaw exists in file xmlrpc-epi-php.c in the PHP_to_XMLRPC_worker() function. A remote attacker can exploit this to disclose memory contents, crash the application process, or have other impact.

 - A type confusion flaw exists in file wddx.c when handling WDDX packet deserialization. A remote attacker can exploit this to execute arbitrary code.

 - A flaw exists in file lsapilib.c when handling requests due to the LSAPI module failing to clear its secrets in child processes. A remote attacker can exploit this to gain access to memory contents, resulting in the disclosure of sensitive information.

 - A flaw exists in file lsapilib.c in the parseRequest() function due to a failure to properly sanitize input passed through multiple, unspecified parameters. A remote attacker can exploit this to cause a denial of service.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote host is 7.x prior to 7.0.2. It is, therefore, affected by multiple vulnerabilities :

 - An out-of-bounds read error exists in the gdImageRotateInterpolated() function in file gd_interpolation.c when handling background colors. A remote attacker can exploit this to disclose memory contents or crash the application. (CVE-2016-1903)

 - An integer overflow condition exists in file exec.c in the escapeshellarg() and escapeshellcmd() functions due to a failure to properly validate user-supplied string input. A remote attacker can exploit this to cause a heap-based overflow, resulting in a denial of service or the execution of arbitrary code. (CVE-2016-1904)

 - A use-after-free error exists in file wddx.c in the php_wddx_pop_element() function when handling WDDX packet deserialization. A remote attacker can exploit this, by dereferencing already freed memory, to execute arbitrary code.

 - A type confusion flaw exists in file xmlrpc-epi-php.c in the PHP_to_XMLRPC_worker() function. A remote attacker can exploit this to disclose memory contents, crash the application process, or have other impact.

 - A type confusion flaw exists in file wddx.c when handling WDDX packet deserialization. A remote attacker can exploit this to execute arbitrary code.

 - An unspecified flaw exists in file fpm_log.c in the fpm_log_write() function when handling very long HTTP requests. A local attacker can exploit this to obtain sensitive information, via access to the access log file.

 - A flaw exists in file lsapilib.c when handling requests due to the LSAPI module failing to clear its secrets in child processes. A remote attacker can exploit this to gain access to memory contents, resulting in the disclosure of sensitive information.

 - A flaw exists in file lsapilib.c in the parseRequest() function due to a failure to properly sanitize input passed through multiple, unspecified parameters. A remote attacker can exploit this to cause a denial of service.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

  - CVE-2015-7803: Specially crafted .phar files with a     crafted TAR archive entry allowed remote attackers to     cause a Denial of Service (DoS) [bsc#949961]

  - CVE-2016-1903: Specially crafted image files could could     allow remote attackers read unspecified memory when     rotating images [bsc#962057]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2952-1 fixed vulnerabilities in PHP. One of the backported patches caused a regression in the PHP Soap client. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories.
(CVE-2014-9767)

It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8835, CVE-2016-3185)

It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases. A man in the middle attacker could possibly use this issue to downgrade and snoop on TLS connections. This vulnerability is known as BACKRONYM. (CVE-2015-8838)

It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE-2016-1903)

Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-2554)

It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-3141)

It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information.
(CVE-2016-3142)

It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When running under PHP-FPM, this could result in XML external entity injection and entity expansion issues.
This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically strong pseudo-random bytes. (No CVE number)

It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10.
(CVE number pending)

It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number pending)

It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending)

It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2952-1 advisory.

    It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip     files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767)

    It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-8835, CVE-2016-3185)

    It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases.
    A machine-in-the-middle attacker could possibly use this issue to downgrade and snoop on TLS connections.
    This vulnerability is known as BACKRONYM. (CVE-2015-8838)

    It was discovered that PHP incorrectly handled the imagerotate function. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information.
    This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE-2016-1903)

    Hans Jerry Illikainen discovered that the PHP phar extension incorrectly handled certain tar archives. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2016-2554)

    It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote     attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-3141)

    It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive     information. (CVE-2016-3142)

    It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When     running under PHP-FPM, this could result in XML external entity injection and entity expansion issues.
    This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number)

    It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically     strong pseudo-random bytes. (No CVE number)

    It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

    It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE number pending)

    It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number     pending)

    It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

    It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE number pending)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote host is 7.x prior to 7.0.2. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the     gdImageRotateInterpolated() function in file     gd_interpolation.c when handling background colors.
    A remote attacker can exploit this to disclose memory     contents or crash the application. (CVE-2016-1903)

  - An integer overflow condition exists in file exec.c     in the escapeshellarg() and escapeshellcmd() functions     due to a failure to properly validate user-supplied     string input. A remote attacker can exploit this to     cause a heap-based overflow, resulting in a denial of     service or the execution of arbitrary code.
    (CVE-2016-1904)

  - A use-after-free error exists in file wddx.c in the     php_wddx_pop_element() function when handling WDDX     packet deserialization. A remote attacker can exploit     this, by dereferencing already freed memory, to execute     arbitrary code.

  - A type confusion flaw exists in file xmlrpc-epi-php.c     in the PHP_to_XMLRPC_worker() function. A remote     attacker can exploit this to disclose memory contents,     crash the application process, or have other impact.

  - A type confusion flaw exists in file wddx.c when     handling WDDX packet deserialization. A remote attacker     can exploit this to execute arbitrary code.

  - An unspecified flaw exists in file fpm_log.c in the     fpm_log_write() function when handling very long     HTTP requests. A local attacker can exploit this to     obtain sensitive information, via access to the     access log file. (CVE-2016-5114)

  - A flaw exists in file lsapilib.c when handling requests     due to the LSAPI module failing to clear its secrets in     child processes. A remote attacker can exploit this to     gain access to memory contents, resulting in the     disclosure of sensitive information.

  - A flaw exists in file lsapilib.c in the parseRequest()     function due to a failure to properly sanitize input     passed through multiple, unspecified parameters. A     remote attacker can exploit this to cause a denial of     service.

According to its banner, the version of PHP running on the remote host is 5.5.x prior to 5.5.31 or 5.6.x prior to 5.6.17. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the     gdImageRotateInterpolated() function in file     gd_interpolation.c when handling background colors.
    A remote attacker can exploit this to disclose memory     contents or crash the application. (CVE-2016-1903)

  - An unspecified flaw exists in file fpm_log.c in the     fpm_log_write() function when handling very long     HTTP requests. A local attacker can exploit this to     obtain sensitive information, via access to the     access log file. (CVE-2016-5114)

  - A use-after-free error exists in file wddx.c in the     php_wddx_pop_element() function when handling WDDX     packet deserialization. A remote attacker can exploit     this, by dereferencing already freed memory, to execute     arbitrary code.

  - A type confusion flaw exists in file xmlrpc-epi-php.c     in the PHP_to_XMLRPC_worker() function. A remote     attacker can exploit this to disclose memory contents,     crash the application process, or have other impact.

  - A type confusion flaw exists in file wddx.c when     handling WDDX packet deserialization. A remote attacker     can exploit this to execute arbitrary code.

  - A flaw exists in file lsapilib.c when handling requests     due to the LSAPI module failing to clear its secrets in     child processes. A remote attacker can exploit this to     gain access to memory contents, resulting in the     disclosure of sensitive information.

  - A flaw exists in file lsapilib.c in the parseRequest()     function due to a failure to properly sanitize input     passed through multiple, unspecified parameters. A     remote attacker can exploit this to cause a denial of     service.

This update for php5 fixes the following issues :

  - CVE-2015-7803: Specially crafted .phar files with a     crafted TAR archive entry allowed remote attackers to     cause a Denial of Service (DoS) [bsc#949961]

  - CVE-2016-1903: Specially crafted image files could could     allow remote attackers read unspecified memory when     rotating images [bsc#962057]

This update was imported from the SUSE:SLE-12:Update update project.

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

This update for php5 fixes the following issues :

  - CVE-2015-7803: Specially crafted .phar files with a     crafted TAR archive entry allowed remote attackers to     cause a Denial of Service (DoS) [bsc#949961]

  - CVE-2015-7804: Specially crafted .phar files with a     crafted ZIP archive entry referencing a file '/' allowed     remote attackers to cause a Denial of Service (DoS) or     potentially leak unspecified memory content [bsc#949961]

  - CVE-2016-1903: Specially crafted image files could     allowed remote attackers read unspecified memory when     rotating images [bsc#962057]

Versions of PHP 5.5.x prior to 5.5.31, or 5.6.x prior to 5.6.17, or 7.0.x prior to 7.0.2 are vulnerable to the following issues :

 - A use-after-free error exists in the 'php_wddx_pop_element()' function in 'ext/wddx/wddx.c' that is triggered when handling WDDX packet deserialization.  This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw exists in the 'PHP_to_XMLRPC_worker()' function in 'ext/xmlrpc/xmlrpc-epi-php.c.' This may allow a remote attacker to potentially disclose memory contents, crash the process or have a more severe impact.
 - A type confusion flaw exists in 'ext/wddx/wddx.c' that is triggered when handling session WDDX packet deserialization.  This may allow a remote attacker to potentially execute arbitrary code.
 - An out-of-bounds read flaw exists in the 'gdImageRotateInterpolated()' function in 'ext/gd/libgd/gd_interpolation.c' that is triggered when handling background colors.  This may allow a remote attacker to cause a crash or potentially disclose memory contents. (CVE-2016-1903)
 - A flaw exists in the 'fpm_log_write()' function in 'sapi/fpm/fpm/fpm_log.c' that is triggered when handling overly long HTTP requests.  This may allow a local attacker with permissions to read the access log file to potentially disclose sensitive memory contents.
 - A flaw in 'sapi/litespeed/lsapilib.c' that is due to the LSAPI module failing to clear its secret in the child processes when handling requests. This may allow a remote attacker to gain access to sensitive information in memory space.
 - A flaw exists in the 'parseRequest()' function in 'sapi/litespeed/lsapilib.c' that is triggered as input passed via multiple variables in LSAPI requests is not properly sanitized. This may allow a remote attacker to cause a denial of service.

The imagerotate function lacked validation of the background color variable, an integer which represents an index of the color palette. A number larger than the length of the color palette could be used in the function, reading beyond the memory of the color palette and causing an information leak.

ID	Name	Product	Family	Severity
98873	PHP 5.6.x < 5.6.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98842	PHP 7.x < 7.0.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
119973	SUSE SLES12 Security Update : php5 (SUSE-SU-2016:0284-1)	Nessus	SuSE Local Security Checks	critical
90825	Ubuntu 15.10 : php5 regression (USN-2952-2)	Nessus	Ubuntu Local Security Checks	critical
90677	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2952-1)	Nessus	Ubuntu Local Security Checks	critical
88680	PHP 7.x < 7.0.2 Multiple Vulnerabilities	Nessus	CGI abuses	high
88679	PHP prior to 5.5.x < 5.5.31 / 5.6.x < 5.6.17 Multiple Vulnerabilities	Nessus	CGI abuses	critical
88611	openSUSE Security Update : php5 (openSUSE-2016-157)	Nessus	SuSE Local Security Checks	critical
88567	Slackware 14.0 / 14.1 / current : php (SSA:2016-034-04)	Nessus	Slackware Local Security Checks	critical
88533	openSUSE Security Update : php5 (openSUSE-2016-100)	Nessus	SuSE Local Security Checks	critical
9063	PHP 5.5.x < 5.5.31 / 5.6.x < 5.6.17 / 7.0.x < 7.0.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
87974	Amazon Linux AMI : php56 / php55 (ALAS-2016-640)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2016-1903

critical

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical