Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large integer argument, a related issue to CVE-2016-5096.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.8. It is, therefore, affected by multiple vulnerabilities :

 - An integer overflow condition exists in the _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5766)

 - A double-free error exists in the _php_mb_regex_ereg_replace_exec() function within file ext/mbstring/php_mbregex.c when handling a failed callback execution. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-5768)

 - An integer overflow condition exists within file ext/mcrypt/mcrypt.c due to improper validation of user-supplied input when handling data values. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5769)

 - An integer overflow condition exists within file ext/spl/spl_directory.c, triggered by an int/size_t type confusion error, that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2016-5770)

 - A use-after-free error exists in the garbage collection algorithm within file ext/spl/spl_array.c. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5771)

 - A double-free error exists in the php_wddx_process_data() function within file ext/wddx/wddx.c when handling specially crafted XML content. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-5772)

 - A use-after-free error exists in the garbage collection algorithm within file ext/zip/php_zip.c. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5773)

 - An integer overflow condition exists in the json_decode() and json_utf8_to_utf16() functions within file ext/standard/php_smart_str.h due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

 - An out-of-bounds read error exists in the pass2_no_dither() function within file ext/gd/libgd/gd_topal.c that allows an unauthenticated, remote attacker to cause a denial of service condition or disclose memory contents.

 - An integer overflow condition exists within file ext/standard/string.c when handling string lengths due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

 - A NULL pointer dereference flaw exists in the _gdScaleVert() function within file ext/gd/libgd/gd_interpolation.c that is triggered when handling _gdContributionsCalc return values. An unauthenticated, remote attacker can exploit this to cause a denial of service condition.

 - An integer overflow condition exists in the nl2br() function within file ext/standard/string.c when handling new_length values due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

 - An integer overflow condition exists in multiple functions within file ext/standard/string.c when handling string values due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.23. It is, therefore, affected by multiple vulnerabilities :

 - An invalid free flaw exists in the phar_extract_file() function within file ext/phar/phar_object.c that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2016-4473)

 - An integer overflow condition exists in the _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5766)

 - An integer overflow condition exists in the gdImagePaletteToTrueColor() function within file ext/gd/libgd/gd.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5767)

 - A double-free error exists in the _php_mb_regex_ereg_replace_exec() function within file ext/mbstring/php_mbregex.c when handling a failed callback execution. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-5768)

 - An integer overflow condition exists within file ext/mcrypt/mcrypt.c due to improper validation of user-supplied input when handling data values. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-5769)

 - An integer overflow condition exists within file ext/spl/spl_directory.c, triggered by an int/size_t type confusion error, that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2016-5770)

 - A use-after-free error exists in the garbage collection algorithm within file ext/spl/spl_array.c. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5771)

 - A double-free error exists in the php_wddx_process_data() function within file ext/wddx/wddx.c when handling specially crafted XML content. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2016-5772)

 - A use-after-free error exists in the garbage collection algorithm within file ext/zip/php_zip.c. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-5773)

 - An integer overflow condition exists in the json_decode() and json_utf8_to_utf16() functions within file ext/standard/php_smart_str.h due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

 - An out-of-bounds read error exists in the pass2_no_dither() function within file ext/gd/libgd/gd_topal.c that allows an unauthenticated, remote attacker to cause a denial of service condition or disclose memory contents.

 - An integer overflow condition exists within file ext/standard/string.c when handling string lengths due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

 - A NULL pointer dereference flaw exists in the _gdScaleVert() function within file ext/gd/libgd/gd_interpolation.c that is triggered when handling _gdContributionsCalc return values. An unauthenticated, remote attacker can exploit this to cause a denial of service condition.

 - An integer overflow condition exists in multiple functions within file ext/standard/string.c when handling string values due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X version 10.x prior to 10.12, and is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2016-4694)
 - apache_mod_php (CVE-2016-5768, CVE-2016-5769, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6174, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297)
 - Apple HSSPI Support (CVE-2016-4697)
 - AppleEFIRuntime (CVE-2016-4696)
 - AppleMobileFileIntegrity (CVE-2016-4698)
 - AppleUUC (CVE-2016-4699, CVE-2016-4700)
 - Application Firewall (CVE-2016-4701)
 - ATS (CVE-2016-4779)
 - Audio (CVE-2016-4702)
 - Bluetooth (CVE-2016-4703)
 - cd9660 (CVE-2016-4706)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711)
 - CoreCrypto (CVE-2016-4712)
 - CoreDisplay (CVE-2016-4713)
 - curl (CVE-2016-0755, CVE-2016-4606)
 - Date & Time Pref Pane (CVE-2016-4715)
 - DiskArbitration (CVE-2016-4716)
 - File Bookmark (CVE-2016-4717)
 - FontParser (CVE-2016-4718)
 - IDS - Connectivity (CVE-2016-4722)
 - Intel Graphics Driver (CVE-2016-4723, CVE-2016-7582)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - IOThunderboltFamily (CVE-2016-4727)
 - Kerberos v5 PAM module (CVE-2016-4745)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4775, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - lib archive (CVE-2016-4736)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxpc (CVE-2016-4617)
 - libxslt (CVE-2016-4738)
 - mDNSResponder (CVE-2016-4739)
 - NSSecureTextField (CVE-2016-4742)
 - Perl (CVE-2016-4748, CVE-2016-4750)
 - Security (CVE-2016-4752, CVE-2016-4753)
 - Terminal (CVE-2016-4755)
 - WindowServer (CVE-2016-4709, CVE-2016-4710)

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple HSSPI Support
  - AppleEFIRuntime
  - AppleMobileFileIntegrity
  - AppleUCC
  - Application Firewall
  - ATS
  - Audio
  - Bluetooth
  - cd9660
  - CFNetwork
  - CommonCrypto
  - CoreCrypto
  - CoreDisplay
  - curl
  - Date & Time Pref Pane
  - DiskArbitration
  - File Bookmark
  - FontParser
  - IDS - Connectivity
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOThunderboltFamily
  - Kerberos v5 PAM module
  - Kernel
  - libarchive
  - libxml2
  - libxpc
  - libxslt
  - mDNSResponder
  - NSSecureTextField
  - Perl
  - S2 Camera
  - Security
  - Terminal
  - WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

- CVE-2016-4473.patch An invalid free may occur under     certain conditions when processing phar-compatible     archives.

  - CVE-2016-4538.patch The bcpowmod function in     ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 accepts a negative integer     for the scale argument, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a crafted call. (already fixed with     patch for CVE-2016-4537)

  - CVE-2016-5114.patch sapi/fpm/fpm/fpm_log.c in PHP before     5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2     misinterprets the semantics of the snprintf return     value, which allows attackers to obtain sensitive     information from process memory or cause a denial of     service (out-of-bounds read and buffer overflow) via a     long string, as demonstrated by a long URI in a     configuration with custom REQUEST_URI logging.

  - CVE-2016-5399.patch Improper error handling in bzread()

  - CVE-2016-5768.patch Double free vulnerability in the
    _php_mb_regex_ereg_replace_exec function in     php_mbregex.c in the mbstring extension in PHP before     5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows     remote attackers to execute arbitrary code or cause a     denial of service (application crash) by leveraging a     callback exception.

  - CVE-2016-5769.patch Multiple integer overflows in     mcrypt.c in the mcrypt extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via a crafted length value,     related to the (1) mcrypt_generic and (2)     mdecrypt_generic functions.

  - CVE-2016-5770.patch Integer overflow in the     SplFileObject::fread function in spl_directory.c in the     SPL extension in PHP before 5.5.37 and 5.6.x before     5.6.23 allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a     large integer argument, a related issue to     CVE-2016-5096.

  - CVE-2016-5771.patch spl_array.c in the SPL extension in     PHP before 5.5.37 and 5.6.x before 5.6.23 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data.

  - CVE-2016-5772.patch Double free vulnerability in the     php_wddx_process_data function in wddx.c in the WDDX     extension in PHP before 5.5.37, 5.6.x before 5.6.23, and     7.x before 7.0.8 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via crafted XML data that is     mishandled in a wddx_deserialize call.

  - CVE-2016-5773.patch php_zip.c in the zip extension in     PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before     7.0.8 improperly interacts with the unserialize     implementation and garbage collection, which allows     remote attackers to execute arbitrary code or cause a     denial of service (use-after-free and application crash)     via crafted serialized data containing a ZipArchive     object.

  - CVE-2016-6289.patch Integer overflow in the     virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in     PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before     7.0.9 allows remote attackers to cause a denial of     service (stack-based buffer overflow) or possibly have     unspecified other impact via a crafted extract operation     on a ZIP archive.

  - CVE-2016-6290.patch ext/session/session.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly maintain a certain hash data structure,     which allows remote attackers to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via vectors related to session     deserialization.

  - CVE-2016-6291.patch The exif_process_IFD_in_MAKERNOTE     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (out-of-bounds     array access and memory corruption), obtain sensitive     information from process memory, or possibly have     unspecified other impact via a crafted JPEG image.

  - CVE-2016-6292.patch The exif_process_user_comment     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted JPEG     image.

  - CVE-2016-6294.patch The locale_accept_from_http function     in ext/intl/locale/locale_methods.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly restrict calls to the ICU     uloc_acceptLanguageFromHTTP function, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a call with a long argument.

  - CVE-2016-6295.patch ext/snmp/snmp.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9     improperly interacts with the unserialize implementation     and garbage collection, which allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via crafted serialized data, a related issue to     CVE-2016-5773.

  - CVE-2016-6296.patch Integer signedness error in the     simplestring_addn function in simplestring.c in     xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38,     5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote     attackers to cause a denial of service (heap-based     buffer overflow) or possibly have unspecified other     impact via a long first argument to the PHP     xmlrpc_encode_request function.

  - CVE-2016-6297.patch Integer overflow in the     php_stream_zip_opener function in ext/zip/zip_stream.c     in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x     before 7.0.9 allows remote attackers to cause a denial     of service (stack-based buffer overflow) or possibly     have unspecified other impact via a crafted zip:// URL.

  - BUG-70436.patch Use After Free Vulnerability in     unserialize()

  - BUG-72681.patch PHP Session Data Injection     Vulnerability, consume data even if we're not storing     them.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The specific version of PHP that the system is running is reportedly affected by the following vulnerabilities:

- PHP contains an integer overflow condition in the json_decode() and json_utf8_to_utf16() functions in ext/standard/php_smart_str.h. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.

- PHP contains an out-of-bounds read flaw in the pass2_no_dither() function in ext/gd/libgd/gd_topal.c that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.

- PHP contains an integer overflow condition in ext/standard/string.c. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.

- PHP contains a double-free flaw in the _php_mb_regex_ereg_replace_exec() function in ext/mbstring/php_mbregex.c that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)

- PHP contains a NULL pointer dereference flaw in the _gdScaleVert() function in ext/gd/libgd/gd_interpolation.c that is triggered during the handling of _gdContributionsCalc return values. This may allow a remote attacker to cause a denial of service in a process linked against PHP.

- PHP contains an integer overflow condition in ext/spl/spl_directory.c. The issue is triggered by an int/size_t confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)

- PHP contains an integer overflow condition in ext/mcrypt/mcrypt.c. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)

- PHP contains an integer overflow condition in the nl2br() function in ext/standard/string.c. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.

- PHP contains an integer overflow condition in multiple functions in ext/standard/string.c. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.

- PHP contains a double-free flaw in the php_wddx_process_data() function in ext/wddx/wddx.c that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)

- PHP contains an integer overflow condition in the gdImagePaletteToTrueColor() function in ext/gd/libgd/gd.c. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)

- PHP contains an invalid free flaw in the phar_extract_file() function in ext/phar/phar_object.c. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)

- PHP contains an integer overflow condition in the _gd2GetHeader() function in ext/gd/libgd/gd_gd2.c. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)

This update for php5 fixes the following issues :

  - It is possible to launch a web server with 'php -S     localhost:8080' It used to be possible to set an     arbitrary $HTTP_PROXY environment variable for request     handlers -- like CGI scripts -- by including a specially     crafted HTTP header in the request (CVE-2016-5385). As a     result, these server components would potentially direct     all their outgoing HTTP traffic through a malicious     proxy server. This patch fixes the issue: the updated     php server ignores such HTTP headers and never sets     $HTTP_PROXY for sub-processes. (bnc#988486)

  - There was multiple cases where a remote attacker could     trigger a double free and, given specific PHP code using     callbacks, trigger code execution vectors.
    (bnc#986246,bnc#986244,CVE-2016-5768,CVE-2016-5772)

  - It was possible to inject header or content information     (XSS) when a user was using internet explorer as the     browser. (bnc#986004, CVE-2015-8935)

  - In several cases it was possible for a integer overflow     to trigger an excessive memory allocation (bnc#986392,     bnc#986388, bnc#986386, bnc#986393, CVE-2016-5770,     CVE-2016-5769, CVE-2016-5766, CVE-2016-5767)

  - It was possible for an attacker to abuse the garbage     collector to free a target array. At this point an     attacker could craft a fake zval object and exploit the     PHP process by taking over the EIP/RIP. (bnc#986391,     CVE-2016-5771)

This update was imported from the SUSE:SLE-12:Update update project.

A stack consumption vulnerability in GD in PHP allows remote attackers to cause a denial of service via a crafted imagefilltoborder call.
(CVE-2015-8874)

An integer overflow, leading to a heap-based buffer overflow was found in the imagecreatefromgd2() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted GD2 image.
(CVE-2016-5766)

An integer overflow, leading to a heap-based buffer overflow was found in the gdImagePaletteToTrueColor() function of PHP's gd extension. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application, using gd via a specially crafted image buffer.
(CVE-2016-5767)

A double free flaw was found in the mb_ereg_replace_callback() function of php which is used to perform regex search. This flaw could possibly cause a PHP application to crash. (CVE-2016-5768)

The mcrypt_generic() and mdecrypt_generic() functions are prone to integer overflows, resulting in a heap-based overflow. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5769)

A type confusion issue was found in the SPLFileObject fread() function. A remote attacker able to submit a specially crafted input to a PHP application, which uses this function, could use this flaw to execute arbitrary code with the privileges of the user running that PHP application. (CVE-2016-5770)

A use-after-free vulnerability that can occur when calling unserialize() on untrusted input was discovered. A remote attacker could use this flaw to crash a PHP application or execute arbitrary code with the privileges of the user running that PHP application if the application unserializes untrusted input. (CVE-2016-5771 , CVE-2016-5773)

A double free can occur in wddx_deserialize() when trying to deserialize malicious XML input from user's request. This flaw could possibly cause a PHP application to crash. (CVE-2016-5772)

It was discovered that PHP did not properly protect against the HTTP_PROXY variable name clash. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a PHP script to an attacker-controlled proxy via a malicious HTTP request.
(CVE-2016-5385)

(Updated on 2016-08-17: CVE-2016-5385 was fixed in this release but was not previously part of this errata)

23 Jun 2016, **PHP 5.6.23**

**Core:**

  - Fixed bug php#72275 (Integer Overflow in     json_encode()/json_decode()/json_utf8_to_utf16()).
    (Stas)

  - Fixed bug php#72400 (Integer Overflow in     addcslashes/addslashes). (Stas)

  - Fixed bug php#72403 (Integer Overflow in Length of     String-typed ZVAL). (Stas)

**GD:**

  - Fixed bug php#72298 (pass2_no_dither out-of-bounds     access). (Stas)

  - Fixed bug php#72337 (invalid dimensions can lead to     crash) (Pierre)

  - Fixed bug php#72339 (Integer Overflow in _gd2GetHeader()     resulting in heap overflow). (Pierre)

  - Fixed bug php#72407 (NULL pointer Dereference at
    _gdScaleVert). (Stas)

  - Fixed bug php#72446 (Integer Overflow in     gdImagePaletteToTrueColor() resulting in heap overflow).
    (Pierre)

**Intl:**

  - Fixed bug php#70484 (selectordinal doesn't work with     named parameters). (Anatol)

**mbstring:**

  - Fixed bug php#72402 (_php_mb_regex_ereg_replace_exec -     double free). (Stas)

**mcrypt:**

  - Fixed bug php#72455 (Heap Overflow due to integer     overflows). (Stas)

**Phar:**

  - Fixed bug php#72321 (invalid free in     phar_extract_file()). (hji at dyntopia dot com)

**SPL:**

  - Fixed bug php#72262 (int/size_t confusion in     SplFileObject::fread). (Stas)

  - Fixed bug php#72433 (Use After Free Vulnerability in     PHP's GC algorithm and unserialize). (Dmitry)

**OpenSSL:**

  - Fixed bug php#72140 (segfault after calling     ERR_free_strings()). (Jakub Zelenka)

**WDDX:**

  - Fixed bug php#72340 (Double Free Courruption in     wddx_deserialize). (Stas)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.23, which includes additional bug fixes. Please refer to the upstream changelog for more information :

Versions of PHP 5.5.x prior to 5.5.37, or 5.6.x prior to 5.6.23, or 7.0.x prior to 7.0.8 are vulnerable to the following issues :

 - PHP 'ext/mysqlnd/mysqlnd.c' contains a flaw that is due to the program failing to properly enforce the requirement of an SSL/TLS connection when the '--ssl client' option is used. This may allow a MitM (Man-in-the-Middle) attacker to downgrade the connection to plain HTTP when expected to be HTTPS. (CVE-2015-8838)
 - An integer overflow condition exists in the 'getFromIndex()'' and 'getFromName()' methods of 'ZipArchive'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted ZIP file. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3078)
 - An XXE (Xml eXternal Entity) injection and expansion flaw affects the 'libxml_disable_entity_loader()' function in the source file 'ext/libxml/libxml.c' in PHP-FPM that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to sensitive information or cause a denial of service. (CVE-2015-8866)
 - An integer overflow condition exists in the 'php_filter_encode_url()' function in 'ext/filter/sanitizing_filters.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4345)
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4346)
 - The program contains an out-of-bounds read flaw in 'ext/intl/grapheme/grapheme_string.c' that is triggered when handling negative offsets in 'zif_grapheme_stripos'. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4540, CVE-2016-4541)
 - An out-of-bounds read flaw exists in the 'php_str2num()' function in 'ext/bcmath/bcmath.c' that is triggered when accepting negative scales. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4537, CVE-2016-4538)
 - An out-of-bounds read flaw exists in the 'exif_read_data()' function in 'ext/exif/exif.c' that is triggered when handling exif headers. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
 - A flaw in the 'xml_parse_into_struct()' function in 'ext/xml/xml.c' is triggered during the handling of a specially crafted XML content. This may allow a remote attacker to cause a denial of service. (CVE-2016-4539)
 - A double-free flaw exists in the 'php_formatted_print()' function in 'ext/standard/formatted_print.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-8880)
 - A flaw exists in 'main/php_open_temporary_file.c' that is triggered as thread safety is not ensured during the handling of temporary directories. This may allow a remote attacker to cause a denial of service. (CVE-2015-8878)
 - An integer overflow flaw exists in the 'php_html_entities()' and 'php_filter_full_special_chars()' functions in 'ext/standard/html.c' that is triggered as input is not properly validated. This may allow a remote attacker to have an unspecified impact. No further details have been provided. (CVE-2016-5094, CVE-2016-5095)
 - An integer underflow issue exists in 'ext/standard/file.c' that is triggered as input is not properly validated. This may allow a remote attacker to cause a NULL write and cause a process linked against PHP to crash. (CVE-2016-5096)
 - An out-of-bounds read flaw exists in the '_gdContributionsCalc()' function in 'ext/gd/libgd/gd_interpolation.c'. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2013-7456)
 - An out-of-bounds read flaw exists in the 'get_icu_value_internal()' function within 'ext/intl/locale/locale_methods.c' that is triggered when handling user-supplied input. This may allow a remote attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-5093)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'header()' function does not filter input passed via HTTP headers before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8935)
 - A use-after-free error exists in the garbage collection algorithm in 'ext/zip/php_zip.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5773)
 - An integer overflow condition exists in the 'json_decode()' and 'json_utf8_to_utf16()' functions in 'ext/standard/php_smart_str.h'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.
 - An out-of-bounds read flaw exists within the 'pass2_no_dither()' function inside 'ext/gd/libgd/gd_topal.c' that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw exists within the '_php_mb_regex_ereg_replace_exec()' function inside 'ext/mbstring/php_mbregex.c' that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)
 - An integer overflow condition exists in 'ext/spl/spl_directory.c'. The issue is triggered by an 'int/size_t' confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)
 - An integer overflow condition exists in 'ext/mcrypt/mcrypt.c'. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)
 - An integer overflow condition exists within the 'nl2br()' function inside 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.
 - An integer overflow condition exists within multiple functions in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw within the 'php_wddx_process_data()' function inside 'ext/wddx/wddx.c' that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)
 - An integer overflow condition exists witin the 'gdImagePaletteToTrueColor()' function inside 'ext/gd/libgd/gd.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)
 - An invalid free flaw exists within the 'phar_extract_file()' function inside 'ext/phar/phar_object.c'. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)
 - An integer overflow condition exists within the '_gd2GetHeader()' function inside 'ext/gd/libgd/gd_gd2.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)
 - A use-after-free error exists within the garbage collection algorithm inside 'ext/spl/spl_array.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5771)

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.8. It is, therefore, affected by multiple vulnerabilities :

  - An invalid free flaw exists in the phar_extract_file()     function within file ext/phar/phar_object.c that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2016-4473)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in the nl2br()     function within file ext/standard/string.c when handling     new_length values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.23. It is, therefore, affected by multiple vulnerabilities :

  - An invalid free flaw exists in the phar_extract_file()     function within file ext/phar/phar_object.c that allows     an unauthenticated, remote attacker to have an     unspecified impact. (CVE-2016-4473)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.37. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the GD     graphics library in the gdImageFillToBorder() function     within file gd.c when handling crafted images that have     an overly large negative coordinate. An unauthenticated,     remote attacker can exploit this, via a crafted image,     to crash processes linked against the library.
    (CVE-2015-8874)

  - An integer overflow condition exists in the
    _gd2GetHeader() function in file ext/gd/libgd/gd_gd2.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5766)

  - An integer overflow condition exists in the     gdImagePaletteToTrueColor() function within file     ext/gd/libgd/gd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-5767)

  - A double-free error exists in the
    _php_mb_regex_ereg_replace_exec() function within file     ext/mbstring/php_mbregex.c when handling a failed     callback execution. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5768)

  - An integer overflow condition exists within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input when handling data values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-5769)

  - An integer overflow condition exists within file     ext/spl/spl_directory.c, triggered by an int/size_t     type confusion error, that allows an unauthenticated,     remote attacker to have an unspecified impact.
    (CVE-2016-5770)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/spl/spl_array.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5771)

  - A double-free error exists in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when handling specially crafted XML     content. An unauthenticated, remote attacker     can exploit this to execute arbitrary code.
    (CVE-2016-5772)

  - A use-after-free error exists in the garbage collection     algorithm within file ext/zip/php_zip.c. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-5773)

  - An integer overflow condition exists in the     json_decode() and json_utf8_to_utf16() functions within     file ext/standard/php_smart_str.h due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the execution of arbitrary code.

  - An out-of-bounds read error exists in the     pass2_no_dither() function within file     ext/gd/libgd/gd_topal.c that allows an unauthenticated,     remote attacker to cause a denial of service condition     or disclose memory contents.

  - An integer overflow condition exists within file     ext/standard/string.c when handling string lengths due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A NULL pointer dereference flaw exists in the
    _gdScaleVert() function within file     ext/gd/libgd/gd_interpolation.c that is triggered when     handling _gdContributionsCalc return values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in the nl2br()     function within file ext/standard/string.c when handling     new_length values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

  - An integer overflow condition exists in multiple     functions within file ext/standard/string.c when     handling string values due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to have an unspecified impact.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The PHP Group reports :

Please reference CVE/URL list for details

New php packages are available for Slackware 14.0, 14.1, and -current to fix security issues.

Shotwell was updated to fix the following issues :

  - boo#958382: Shotwell did not perform TLS certificate     verification when publishing photos to external services

ID	Name	Product	Family	Severity
98854	PHP 7.0.x < 7.0.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98813	PHP 5.6.x < 5.6.23 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
9620	Mac OS X 10.x < 10.12 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
93685	macOS < 10.12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
93568	Debian DLA-628-1 : php5 security update	Nessus	Debian Local Security Checks	critical
802010	PHP < 5.5.37, 5.6.23, 7.0.8 Multiple Vulnerabilties	Log Correlation Engine	Web Servers	critical
92714	openSUSE Security Update : php5 (openSUSE-2016-921) (httpoxy)	Nessus	SuSE Local Security Checks	critical
92663	Amazon Linux AMI : php55 / php56 (ALAS-2016-728) (httpoxy)	Nessus	Amazon Linux Local Security Checks	critical
92300	Fedora 24 : php (2016-ec372bddb9)	Nessus	Fedora Local Security Checks	critical
92272	Fedora 22 : php (2016-99fbdc5c34)	Nessus	Fedora Local Security Checks	critical
92239	Fedora 23 : php (2016-34a6b65583)	Nessus	Fedora Local Security Checks	critical
92224	Debian DSA-3618-1 : php5 - security update	Nessus	Debian Local Security Checks	critical
9393	PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
91899	PHP 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus	CGI abuses	critical
91898	PHP 5.6.x < 5.6.23 Multiple Vulnerabilities	Nessus	CGI abuses	critical
91897	PHP 5.5.x < 5.5.37 Multiple Vulnerabilities	Nessus	CGI abuses	critical
91839	FreeBSD : php -- multiple vulnerabilities (66d77c58-3b1d-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
91830	Slackware 14.0 / 14.1 / current : php (SSA:2016-176-01)	Nessus	Slackware Local Security Checks	critical
90108	openSUSE Security Update : shotwell (openSUSE-2016-844)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2016-5770

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical