The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The get_icu_disp_value_src_php function in     ext/intl/locale/locale_methods.c in PHP before 5.3.29,     5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not     properly restrict calls to the ICU uresbund.cpp     component, which allows remote attackers to cause a     denial of service (buffer overflow) or possibly have     unspecified other impact via a locale_get_display_name     call with a long first argument.(CVE-2014-9912)

  - Use-after-free vulnerability in the spl_ptr_heap_insert     function in ext/spl/spl_heap.c in PHP before 5.5.27 and     5.6.x before 5.6.11 allows remote attackers to execute     arbitrary code by triggering a failed     SplMinHeap::compare operation.(CVE-2015-4116)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-7803)

  - A flaw was found in the way the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-7804)

  - ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x     before 5.6.6, when PHP-FPM is used, does not isolate     each thread from libxml_disable_entity_loader changes     in other threads, which allows remote attackers to     conduct XML External Entity (XXE) and XML Entity     Expansion (XEE) attacks via a crafted XML document, a     related issue to CVE-2015-5161.(CVE-2015-8866)

  - Stack consumption vulnerability in GD in PHP before     5.6.12 allows remote attackers to cause a denial of     service via a crafted imagefilltoborder     call.(CVE-2015-8874)

  - It was found that the exif_convert_any_to_int()     function in PHP was vulnerable to floating point     exceptions when parsing tags in image files. A remote     attacker with the ability to upload a malicious image     could crash PHP, causing a Denial of     Service.(CVE-2016-10158)

  - Integer overflow in the phar_parse_pharfile function in     ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before     7.0.15 allows remote attackers to cause a denial of     service (memory consumption or application crash) via a     truncated manifest entry in a PHAR     archive.(CVE-2016-10159)

  - The php_url_parse_ex function in ext/standard/url.c in     PHP before 5.5.38 allows remote attackers to cause a     denial of service (buffer over-read) or possibly have     unspecified other impact via vectors involving the     smart_str data type.(CVE-2016-6288)

  - The exif_process_IFD_in_MAKERNOTE function in     ext/exif/exif.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 allows remote attackers to     cause a denial of service (out-of-bounds array access     and memory corruption), obtain sensitive information     from process memory, or possibly have unspecified other     impact via a crafted JPEG image.(CVE-2016-6291)

  - The exif_process_user_comment function in     ext/exif/exif.c in PHP before 5.5.38, 5.6.x before     5.6.24, and 7.x before 7.0.9 allows remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via a crafted JPEG     image.(CVE-2016-6292)

  - The locale_accept_from_http function in     ext/intl/locale/locale_methods.c in PHP before 5.5.38,     5.6.x before 5.6.24, and 7.x before 7.0.9 does not     properly restrict calls to the ICU     uloc_acceptLanguageFromHTTP function, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a call with a long argument.(CVE-2016-6294)

  - ext/session/session.c in PHP before 5.6.25 and 7.x     before 7.0.10 skips invalid session names in a way that     triggers incorrect parsing, which allows remote     attackers to inject arbitrary-type session data by     leveraging control of a session name, as demonstrated     by object injection.(CVE-2016-7125)

  - The exif_process_IFD_in_TIFF function in     ext/exif/exif.c in PHP before 5.6.25 and 7.x before     7.0.10 mishandles the case of a thumbnail offset that     exceeds the file size, which allows remote attackers to     obtain sensitive information from process memory via a     crafted TIFF image.(CVE-2016-7128)

  - The php_wddx_push_element function in ext/wddx/wddx.c     in PHP before 5.6.26 and 7.x before 7.0.11 allows     remote attackers to cause a denial of service (invalid     pointer access and out-of-bounds read) or possibly have     unspecified other impact via an incorrect boolean     element in a wddxPacket XML document, leading to     mishandling in a wddx_deserialize call.(CVE-2016-7418)

  - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x     before 7.1.7, a stack-based buffer overflow in the     zend_ini_do_op() function in Zend/zend_ini_parser.c     could cause a denial of service or potentially allow     executing code. NOTE: this is only relevant for PHP     applications that accept untrusted input (instead of     the system's php.ini file) for the parse_ini_string or     parse_ini_file function, e.g., a web application for     syntax validation of php.ini     directives.(CVE-2017-11628)

  - An issue was discovered in PHP before 5.6.35, 7.0.x     before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before     7.2.4. Dumpable FPM child processes allow bypassing     opcache access controls because fpm_unix.c makes a     PR_SET_DUMPABLE prctl call, allowing one user (in a     multiuser environment) to obtain sensitive information     from the process memory of a second user's PHP     applications by running gcore on the PID of the PHP-FPM     worker process.(CVE-2018-10545)

  - An issue was discovered in ext/phar/phar_object.c in     PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before     7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS     on the PHAR 403 and 404 error pages via request data of     a request for a .phar file.(CVE-2018-10547)

  - exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP     before 5.6.37, 7.0.x before 7.0.31, 7.1.x before     7.1.20, and 7.2.x before 7.2.8 allows remote attackers     to cause a denial of service (out-of-bounds read and     application crash) via a crafted JPEG     file.(CVE-2018-14851)

  - A cross-site scripting (XSS) vulnerability in Apache2     component of PHP was found. When using     'Transfer-Encoding: chunked', the request allows remote     attackers to potentially run a malicious script in a     victim's browser. This vulnerability can be exploited     only by producing malformed requests and it's believed     it's unlikely to be used in practical cross-site     scripting attack.(CVE-2018-17082)

  - gd_gif_in.c in the GD Graphics Library (aka libgd), as     used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x     before 7.1.13, and 7.2.x before 7.2.1, has an integer     signedness error that leads to an infinite loop via a     crafted GIF file, as demonstrated by a call to the     imagecreatefromgif or imagecreatefromstring PHP     function. This is related to GetCode_ and     gdImageCreateFromGifCtx.(CVE-2018-5711)

  - An issue was discovered in PHP before 5.6.33, 7.0.x     before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before     7.2.1. There is Reflected XSS on the PHAR 404 error     page via the URI of a request for a .phar     file.(CVE-2018-5712)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.9. It is, therefore, affected by multiple vulnerabilities :

 - A man-in-the-middle vulnerability exists, known as 'httpoxy', due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated. (CVE-2016-5385)

 - An overflow condition exists in the php_bz2iop_read() function within file ext/bz2/bz2.c due to improper handling of error conditions. An unauthenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary code. (CVE-2016-5399)

 - A flaw exists in the GD Graphics Library (libgd), specifically in the gdImageScaleTwoPass() function within file gd_interpolation.c, due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-6207)

 - An integer overflow condition exists in the virtual_file_ex() function within file Zend/zend_virtual_cwd.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6289)

 - A use-after-free error exists within the file ext/session/session.c when handling 'var_hash' destruction. An unauthenticated, remote attacker can exploit this to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-6290)

 - An out-of-bounds read error exists in the exif_process_IFD_in_MAKERNOTE() function within file ext/exif/exif.c. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. (CVE-2016-6291)

 - A NULL pointer dereference flaw exists in the exif_process_user_comment() function within file ext/exif/exif.c. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-6292)

 - Multiple out-of-bounds read errors exist in the locale_accept_from_http() function within file ext/intl/locale/locale_methods.c. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or disclose memory contents. (CVE-2016-6293, CVE-2016-6294)

 - A use-after-free error exists within file ext/snmp/snmp.c when handling garbage collection during deserialization of user-supplied input. An unauthenticated, remote attacker can exploit this to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-6295)

 - A heap-based buffer overflow condition exists in the simplestring_addn() function within file simplestring.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6296)

 - An integer overflow condition exists in the php_stream_zip_opener() function within file ext/zip/zip_stream.c due to improper validation of user-supplied input when handling zip streams. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6297)

 - An out-of-bounds read error exists in the GD Graphics Library (libgd), specifically in the gdImageScaleBilinearPalette() function within file gd_interpolation.c, when handling transparent color. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents.

 - A heap-based buffer overflow condition exists in the mdecrypt_generic() function within file ext/mcrypt/mcrypt.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

 - A flaw exists in the curl_unescape() function within file ext/curl/interface.c when handling string lengths. An unauthenticated, remote attacker can exploit this to cause heap corruption, resulting in a denial of service condition.

 - A heap-based buffer overflow condition exists in the mcrypt_generic() function within file ext/mcrypt/mcrypt.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

 - A NULL write flaw exists in the GD Graphics Library (libgd) in the gdImageColorTransparent() function due to improper handling of negative transparent colors. A remote attacker can exploit this to disclose memory contents.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.24. It is, therefore, affected by multiple vulnerabilities :

 - A man-in-the-middle vulnerability exists, known as 'httpoxy', due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server where it may be observed or manipulated. (CVE-2016-5385)

 - An overflow condition exists in the php_bz2iop_read() function within file ext/bz2/bz2.c due to improper handling of error conditions. An unauthenticated, remote attacker can exploit this, via a crafted request, to execute arbitrary code. (CVE-2016-5399)

 - A flaw exists in the GD Graphics Library (libgd), specifically in the gdImageScaleTwoPass() function within file gd_interpolation.c, due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-6207)

 - An integer overflow condition exists in the virtual_file_ex() function within file Zend/zend_virtual_cwd.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6289)

 - A use-after-free error exists within the file ext/session/session.c when handling 'var_hash' destruction. An unauthenticated, remote attacker can exploit this to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-6290)

 - An out-of-bounds read error exists in the exif_process_IFD_in_MAKERNOTE() function within file ext/exif/exif.c. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents. (CVE-2016-6291)

 - A NULL pointer dereference flaw exists in the exif_process_user_comment() function within file ext/exif/exif.c. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-6292)

 - Multiple out-of-bounds read errors exist in the locale_accept_from_http() function within file ext/intl/locale/locale_methods.c. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or disclose memory contents. (CVE-2016-6293, CVE-2016-6294)

 - A use-after-free error exists within file ext/snmp/snmp.c when handling garbage collection during deserialization of user-supplied input. An unauthenticated, remote attacker can exploit this to deference already freed memory, resulting in the execution of arbitrary code. (CVE-2016-6295)

 - A heap-based buffer overflow condition exists in the simplestring_addn() function within file simplestring.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6296)

 - An integer overflow condition exists in the php_stream_zip_opener() function within file ext/zip/zip_stream.c due to improper validation of user-supplied input when handling zip streams. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-6297)

 - An out-of-bounds read error exists in the GD Graphics Library (libgd), specifically in the gdImageScaleBilinearPalette() function within file gd_interpolation.c, when handling transparent color. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or disclose memory contents.

 - A heap-based buffer overflow condition exists in the mdecrypt_generic() function within file ext/mcrypt/mcrypt.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code.

 - A NULL write flaw exists in the GD Graphics Library (libgd) in the gdImageColorTransparent() function due to improper handling of negative transparent colors. A remote attacker can exploit this to disclose memory contents.

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following security issues :

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

  - CVE-2017-9227: A stack out-of-bounds read occurs in     mbc_enc_len() during regular expression searching.
    (bsc#1040883)

  - CVE-2017-9226: A heap out-of-bounds write or read occurs     in next_state_val() during regular expression     compilation. (bsc#1040889)

  - CVE-2017-9224: A stack out-of-bounds read occurs in     match_at() during regular expression searching.
    (bsc#1040891)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2017-9224: stack out-of-bounds read occurs in     match_at() could lead to Denial of service (bsc#1040891)

  - CVE-2017-9226: heap out-of-bounds write orread occurs in     next_state_val() could lead to Denial of     service(bsc#1040889)

  - CVE-2017-9227: stack out-of-bounds read in mbc_enc_len()     could lead to Denial of service (bsc#1040883)

  - CVE-2017-6441: The _zval_get_long_func_ex in     Zend/zend_operators.c in PHP allowed attackers to cause     a denial of service (NULL pointer dereference and     application crash) via crafted use of 'declare(ticks='     in a PHP script (bsc#1032155).

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php5 fixes the following security issues :

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

  - CVE-2017-9227: A stack out-of-bounds read occurs in     mbc_enc_len() during regular expression searching.
    (bsc#1040883)

  - CVE-2017-9226: A heap out-of-bounds write or read occurs     in next_state_val() during regular expression     compilation. (bsc#1040889)

  - CVE-2017-9224: A stack out-of-bounds read occurs in     match_at() during regular expression searching.
    (bsc#1040891)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php53 fixes the following issues: This security issue was fixed :

  - CVE-2017-7272: PHP enabled potential SSRF in     applications that accept an fsockopen hostname argument     with an expectation that the port number is constrained.
    Because a :port syntax was recognized, fsockopen used     the port number that is specified in the hostname     argument, instead of the port number in the second     argument of the function (bsc#1031246)

  - CVE-2016-6294: The locale_accept_from_http function in     ext/intl/locale/locale_methods.c did not properly     restrict calls to the ICU uloc_acceptLanguageFromHTTP     function, which allowed remote attackers to cause a     denial of service (out-of-bounds read) or possibly have     unspecified other impact via a call with a long argument     (bsc#1035111).

  - CVE-2017-9227: An issue was discovered in Oniguruma     6.2.0, as used in mbstring in PHP. A stack out-of-bounds     read occurs in mbc_enc_len() during regular expression     searching. Invalid handling of reg->dmin in     forward_search_range() could result in an invalid     pointer dereference, as an out-of-bounds read from a     stack buffer. (bsc#1040883)

  - CVE-2017-9226: An issue was discovered in Oniguruma     6.2.0, as used in Oniguruma-mod in mbstring in PHP. A     heap out-of-bounds write or read occurs in     next_state_val() during regular expression compilation.
    Octal numbers larger than 0xff are not handled correctly     in fetch_token() and fetch_token_in_cc(). A malformed     regular expression containing an octal number in the     form of '\700' would produce an invalid code point value     larger than 0xff in next_state_val(), resulting in an     out-of-bounds write memory corruption. (bsc#1040889)

  - CVE-2017-9224: An issue was discovered in Oniguruma     6.2.0, as used in Oniguruma-mod in mbstring in PHP. A     stack out-of-bounds read occurs in match_at() during     regular expression searching. A logical error involving     order of validation and access in match_at() could     result in an out-of-bounds read from a stack buffer.
    (bsc#1040891)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201611-22 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker can possibly execute arbitrary code or create a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X version 10.x prior to 10.12, and is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2016-4694)
 - apache_mod_php (CVE-2016-5768, CVE-2016-5769, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6174, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297)
 - Apple HSSPI Support (CVE-2016-4697)
 - AppleEFIRuntime (CVE-2016-4696)
 - AppleMobileFileIntegrity (CVE-2016-4698)
 - AppleUUC (CVE-2016-4699, CVE-2016-4700)
 - Application Firewall (CVE-2016-4701)
 - ATS (CVE-2016-4779)
 - Audio (CVE-2016-4702)
 - Bluetooth (CVE-2016-4703)
 - cd9660 (CVE-2016-4706)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711)
 - CoreCrypto (CVE-2016-4712)
 - CoreDisplay (CVE-2016-4713)
 - curl (CVE-2016-0755, CVE-2016-4606)
 - Date & Time Pref Pane (CVE-2016-4715)
 - DiskArbitration (CVE-2016-4716)
 - File Bookmark (CVE-2016-4717)
 - FontParser (CVE-2016-4718)
 - IDS - Connectivity (CVE-2016-4722)
 - Intel Graphics Driver (CVE-2016-4723, CVE-2016-7582)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - IOThunderboltFamily (CVE-2016-4727)
 - Kerberos v5 PAM module (CVE-2016-4745)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4775, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - lib archive (CVE-2016-4736)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxpc (CVE-2016-4617)
 - libxslt (CVE-2016-4738)
 - mDNSResponder (CVE-2016-4739)
 - NSSecureTextField (CVE-2016-4742)
 - Perl (CVE-2016-4748, CVE-2016-4750)
 - Security (CVE-2016-4752, CVE-2016-4753)
 - Terminal (CVE-2016-4755)
 - WindowServer (CVE-2016-4709, CVE-2016-4710)

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple HSSPI Support
  - AppleEFIRuntime
  - AppleMobileFileIntegrity
  - AppleUCC
  - Application Firewall
  - ATS
  - Audio
  - Bluetooth
  - cd9660
  - CFNetwork
  - CommonCrypto
  - CoreCrypto
  - CoreDisplay
  - curl
  - Date & Time Pref Pane
  - DiskArbitration
  - File Bookmark
  - FontParser
  - IDS - Connectivity
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOThunderboltFamily
  - Kerberos v5 PAM module
  - Kernel
  - libarchive
  - libxml2
  - libxpc
  - libxslt
  - mDNSResponder
  - NSSecureTextField
  - Perl
  - S2 Camera
  - Security
  - Terminal
  - WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

- CVE-2016-4473.patch An invalid free may occur under     certain conditions when processing phar-compatible     archives.

  - CVE-2016-4538.patch The bcpowmod function in     ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 accepts a negative integer     for the scale argument, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a crafted call. (already fixed with     patch for CVE-2016-4537)

  - CVE-2016-5114.patch sapi/fpm/fpm/fpm_log.c in PHP before     5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2     misinterprets the semantics of the snprintf return     value, which allows attackers to obtain sensitive     information from process memory or cause a denial of     service (out-of-bounds read and buffer overflow) via a     long string, as demonstrated by a long URI in a     configuration with custom REQUEST_URI logging.

  - CVE-2016-5399.patch Improper error handling in bzread()

  - CVE-2016-5768.patch Double free vulnerability in the
    _php_mb_regex_ereg_replace_exec function in     php_mbregex.c in the mbstring extension in PHP before     5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 allows     remote attackers to execute arbitrary code or cause a     denial of service (application crash) by leveraging a     callback exception.

  - CVE-2016-5769.patch Multiple integer overflows in     mcrypt.c in the mcrypt extension in PHP before 5.5.37,     5.6.x before 5.6.23, and 7.x before 7.0.8 allow remote     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via a crafted length value,     related to the (1) mcrypt_generic and (2)     mdecrypt_generic functions.

  - CVE-2016-5770.patch Integer overflow in the     SplFileObject::fread function in spl_directory.c in the     SPL extension in PHP before 5.5.37 and 5.6.x before     5.6.23 allows remote attackers to cause a denial of     service or possibly have unspecified other impact via a     large integer argument, a related issue to     CVE-2016-5096.

  - CVE-2016-5771.patch spl_array.c in the SPL extension in     PHP before 5.5.37 and 5.6.x before 5.6.23 improperly     interacts with the unserialize implementation and     garbage collection, which allows remote attackers to     execute arbitrary code or cause a denial of service     (use-after-free and application crash) via crafted     serialized data.

  - CVE-2016-5772.patch Double free vulnerability in the     php_wddx_process_data function in wddx.c in the WDDX     extension in PHP before 5.5.37, 5.6.x before 5.6.23, and     7.x before 7.0.8 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via crafted XML data that is     mishandled in a wddx_deserialize call.

  - CVE-2016-5773.patch php_zip.c in the zip extension in     PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before     7.0.8 improperly interacts with the unserialize     implementation and garbage collection, which allows     remote attackers to execute arbitrary code or cause a     denial of service (use-after-free and application crash)     via crafted serialized data containing a ZipArchive     object.

  - CVE-2016-6289.patch Integer overflow in the     virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in     PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before     7.0.9 allows remote attackers to cause a denial of     service (stack-based buffer overflow) or possibly have     unspecified other impact via a crafted extract operation     on a ZIP archive.

  - CVE-2016-6290.patch ext/session/session.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly maintain a certain hash data structure,     which allows remote attackers to cause a denial of     service (use-after-free) or possibly have unspecified     other impact via vectors related to session     deserialization.

  - CVE-2016-6291.patch The exif_process_IFD_in_MAKERNOTE     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (out-of-bounds     array access and memory corruption), obtain sensitive     information from process memory, or possibly have     unspecified other impact via a crafted JPEG image.

  - CVE-2016-6292.patch The exif_process_user_comment     function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x     before 5.6.24, and 7.x before 7.0.9 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted JPEG     image.

  - CVE-2016-6294.patch The locale_accept_from_http function     in ext/intl/locale/locale_methods.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does     not properly restrict calls to the ICU     uloc_acceptLanguageFromHTTP function, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a call with a long argument.

  - CVE-2016-6295.patch ext/snmp/snmp.c in PHP before     5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9     improperly interacts with the unserialize implementation     and garbage collection, which allows remote attackers to     cause a denial of service (use-after-free and     application crash) or possibly have unspecified other     impact via crafted serialized data, a related issue to     CVE-2016-5773.

  - CVE-2016-6296.patch Integer signedness error in the     simplestring_addn function in simplestring.c in     xmlrpc-epi through 0.54.2, as used in PHP before 5.5.38,     5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote     attackers to cause a denial of service (heap-based     buffer overflow) or possibly have unspecified other     impact via a long first argument to the PHP     xmlrpc_encode_request function.

  - CVE-2016-6297.patch Integer overflow in the     php_stream_zip_opener function in ext/zip/zip_stream.c     in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x     before 7.0.9 allows remote attackers to cause a denial     of service (stack-based buffer overflow) or possibly     have unspecified other impact via a crafted zip:// URL.

  - BUG-70436.patch Use After Free Vulnerability in     unserialize()

  - BUG-72681.patch PHP Session Data Injection     Vulnerability, consume data even if we're not storing     them.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of PHP 5.5.x prior to 5.5.38, or 5.6.x prior to 5.6.24, or 7.0.x prior to 7.0.9 are vulnerable to the following issues :

 - A NULL pointer dereference flaw within the '_gdScaleVert()' function inside of 'ext/gd/libgd/gd_interpolation.c' is triggered during the handling of '_gdContributionsCalc' return values. This may allow a remote attacker to cause a denial of service in a process linked against PHP.
 - A flaw related to missing protection against 'RFC 3875 section 4.1.18' namespace conflicts is triggered when handling requests containing 'Proxy' HTTP headers. These may be stored in the 'HTTP_PROXY' environment variable also commonly used to configure an outbound HTTP proxy for applications. With a specially crafted request, a remote attacker can specify an arbitrary HTTP proxy server to be used by applications relying on the HTTP_PROXY environment variable. (CVE-2016-5385)
 - An out-of-bounds read flaw within the 'gdImageScaleBilinearPalette()' function inside of 'gd_interpolation.c' is triggered when handling transparent colors. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.
 - A flaw within the 'gdImageScaleTwoPass()' function inside of 'gd_interpolation.c' is triggered as certain input is not properly validated. This may allow a context-dependent attacker to crash a process linked against the library. (CVE-2016-6207)
 - A use-after-free error within 'ext/snmp/snmp.c' is triggered during the unserialization of user-supplied input when handling garbage collection. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-6295)
 - An out-of-bounds read flaw within the 'uloc_acceptLanguageFromHTTP()' function inside of 'common/uloc.cpp' may allow a remote attacker to crash a program using the language or potentially disclose memory contents. (CVE-2016-6293, CVE-2016-6294)
 - A use-after-free error within 'ext/session/session.c' is triggered during the handling of 'var_hash destruction'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-6290)
 - An out-of-bounds read flaw within the 'exif_process_IFD_in_MAKERNOTE()' function inside of 'ext/exif/exif.c' may allow a remote attacker to crash a program using the language or potentially disclose memory contents. (CVE-2016-6291)
 - An overflow condition within the 'php_bz2iop_read()' function inside of 'ext/bz2/bz2.c' is triggered as error conditions are not properly handled. With a specially crafted request, a remote attacker can cause a buffer overflow and potentially execute arbitrary code. (CVE-2016-5399)
 - An overflow condition within the 'mdecrypt_generic()' function inside of 'ext/mcrypt/mcrypt.c' is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, crashing a program using the language or potentially allowing the execution of arbitrary code.
 - A NULL pointer dereference flaw within the 'exif_process_user_comment()' function inside of 'ext/exif/exif.c' may allow a remote attacker to crash a program using the language. (CVE-2016-6292)
 - A flaw within the 'curl_unescape()' function inside of 'ext/curl/interface.c' is triggered during the handling of string lengths. This may allow a remote attacker to trigger heap corruption and crash a program using the language.
 - An overflow condition within the 'mcrypt_generic()' function inside of 'ext/mcrypt/mcrypt.c' is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - An integer overflow condition within the 'php_stream_zip_opener()' function inside of 'ext/zip/zip_stream.c' is triggered as user-supplied input is not properly validated when handling zip streams. This may allow a remote attacker to cause a stack-based buffer overflow, crashing a program using the language or potentially allowing the execution of arbitrary code. (CVE-2016-6297)
 - An integer overflow condition within the 'virtual_file_ex()' function inside of 'Zend/zend_virtual_cwd.c' is triggered as user-supplied input is not properly validated when handling variables. This may allow a remote attacker to cause a stack-based buffer overflow, crashing a program using the language or potentially allowing the execution of arbitrary code. (CVE-2016-6289)
 - An overflow condition within the 'simplestring_addn()' function inside of 'simplestring.c.' is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against the library or potentially allowing the execution of arbitrary code. (CVE-2016-6296)
 - A NULL write flaw within the 'gdImageColorTransparent()' function inside of 'gd.c' is triggered during the handling of negative transparent colors. This may allow a context-dependent attacker to disclose memory.
 - An overflow condition within the 'php_url_prase_ex()' function inside of 'ext/standard/url.c' is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a buffer overflow, potentially resulting in a denial of service in a process utilizing the language. (CVE-2016-6288)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3045-1 advisory.

    It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)

    It was discovered that PHP incorrectly handled recursive method calls. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS     and Ubuntu 14.04 LTS. (CVE-2015-8873)

    It was discovered that PHP incorrectly validated certain Exception objects when unserializing data. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8876)

    It was discovered that PHP header() function performed insufficient filtering for Internet Explorer. A     remote attacker could possibly use this issue to perform a XSS attack. This issue only affected Ubuntu     12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8935)

    It was discovered that PHP incorrectly handled certain locale operations. An attacker could use this issue     to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and     Ubuntu 14.04 LTS. (CVE-2016-5093)

    It was discovered that the PHP php_html_entities() function incorrectly handled certain string lengths. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5094,     CVE-2016-5095)

    It was discovered that the PHP fread() function incorrectly handled certain lengths. An attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5096)

    It was discovered that the PHP FastCGI Process Manager (FPM) SAPI incorrectly handled memory in the access     logging feature. An attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly expose sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2016-5114)

    It was discovered that PHP would not protect applications from contents of the HTTP_PROXY environment     variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could     possibly use this issue in combination with scripts that honour the HTTP_PROXY variable to redirect     outgoing HTTP requests. (CVE-2016-5385)

    Hans Jerry Illikainen discovered that the PHP bzread() function incorrectly performed error handling. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2016-5399)

    It was discovered that certain PHP multibyte string functions incorrectly handled memory. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-5768)

    It was discovered that the PHP Mcrypt extension incorrectly handled memory. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5769)

    It was discovered that the PHP garbage collector incorrectly handled certain objects when unserializing     malicious data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu Ubuntu 14.04 LTS.
    (CVE-2016-5771, CVE-2016-5773)

    It was discovered that PHP incorrectly handled memory when unserializing malicious xml data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5772)

    It was discovered that the PHP php_url_parse_ex() function incorrectly handled string termination. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-6288)

    It was discovered that PHP incorrectly handled path lengths when extracting certain Zip archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6289)

    It was discovered that PHP incorrectly handled session deserialization. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-6290)

    It was discovered that PHP incorrectly handled exif headers when processing certain JPEG images. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6291, CVE-2016-6292)

    It was discovered that PHP incorrectly handled certain locale operations. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-6294)

    It was discovered that the PHP garbage collector incorrectly handled certain objects when unserializing     SNMP data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2016-6295)

    It was discovered that the PHP xmlrpc_encode_request() function incorrectly handled certain lengths. An     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6296)

    It was discovered that the PHP php_stream_zip_opener() function incorrectly handled memory. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6297)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

PHP reports :

- Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)

- Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).

- Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).

- Fixed bug #72519 (imagegif/output out-of-bounds access).

- Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).

- Fixed bug #72533 (locale_accept_from_http out-of-bounds access).

- Fixed bug #72541 (size_t overflow lead to heap corruption).

- Fixed bug #72551, bug #72552 (Incorrect casting from size_t to int lead to heap overflow in mdecrypt_generic).

- Fixed bug #72558 (Integer overflow error within
_gdContributionsAlloc()).

- Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).

- Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).

- Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).

- Fixed bug #72613 (Inadequate error handling in bzread()).

- Fixed bug #72618 (NULL pointer Dereference in exif_process_user_comment).

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.24, which includes additional bug fixes. Please refer to the upstream changelog for more information :

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.9. It is, therefore, affected by multiple vulnerabilities :

  - A man-in-the-middle vulnerability exists, known as     'httpoxy', due to a failure to properly resolve     namespace conflicts in accordance with RFC 3875 section     4.1.18. The HTTP_PROXY environment variable is set based     on untrusted user data in the 'Proxy' header of HTTP     requests. The HTTP_PROXY environment variable is used by     some web client libraries to specify a remote proxy     server. An unauthenticated, remote attacker can exploit     this, via a crafted 'Proxy' header in an HTTP request,     to redirect an application's internal HTTP traffic to an     arbitrary proxy server where it may be observed or     manipulated. (CVE-2016-5385)

  - An overflow condition exists in the php_bz2iop_read()     function within file ext/bz2/bz2.c due to improper     handling of error conditions. An unauthenticated, remote     attacker can exploit this, via a crafted request, to     execute arbitrary code. (CVE-2016-5399)

  - A flaw exists in the GD Graphics Library (libgd),     specifically in the gdImageScaleTwoPass() function     within file gd_interpolation.c, due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-6207)

  - An integer overflow condition exists in the     virtual_file_ex() function within file     Zend/zend_virtual_cwd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-6289)

  - A use-after-free error exists within the file     ext/session/session.c when handling 'var_hash'     destruction. An unauthenticated, remote attacker can     exploit this to deference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-6290)

  - An out-of-bounds read error exists in the     exif_process_IFD_in_MAKERNOTE() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     disclose memory contents. (CVE-2016-6291)

  - A NULL pointer dereference flaw exists in the     exif_process_user_comment() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2016-6292)

  - Multiple out-of-bounds read errors exist in the     locale_accept_from_http() function within file     ext/intl/locale/locale_methods.c. An unauthenticated,     remote attacker can exploit these to cause a denial of     service condition or disclose memory contents.
    (CVE-2016-6293, CVE-2016-6294)

  - A use-after-free error exists within file     ext/snmp/snmp.c when handling garbage collection during     deserialization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-6295)

  - A heap-based buffer overflow condition exists in the     simplestring_addn() function within file simplestring.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6296)

  - An integer overflow condition exists in the     php_stream_zip_opener() function within file     ext/zip/zip_stream.c due to improper validation of     user-supplied input when handling zip streams. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6297)

  - An out-of-bounds read error exists in the GD Graphics     Library (libgd), specifically in the     gdImageScaleBilinearPalette() function within file     gd_interpolation.c, when handling transparent color. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose     memory contents.

  - A heap-based buffer overflow condition exists in the     mdecrypt_generic() function within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code.

  - A flaw exists in the curl_unescape() function within     file ext/curl/interface.c when handling string lengths.
    An unauthenticated, remote attacker can exploit this to     cause heap corruption, resulting in a denial of service     condition.

  - A heap-based buffer overflow condition exists in the     mcrypt_generic() function within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code.

  - A NULL write flaw exists in the GD Graphics Library     (libgd) in the gdImageColorTransparent() function due to     improper handling of negative transparent colors. A     remote attacker can exploit this to disclose memory     contents.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.24. It is, therefore, affected by multiple vulnerabilities :

  - A man-in-the-middle vulnerability exists, known as     'httpoxy', due to a failure to properly resolve     namespace conflicts in accordance with RFC 3875 section     4.1.18. The HTTP_PROXY environment variable is set based     on untrusted user data in the 'Proxy' header of HTTP     requests. The HTTP_PROXY environment variable is used by     some web client libraries to specify a remote proxy     server. An unauthenticated, remote attacker can exploit     this, via a crafted 'Proxy' header in an HTTP request,     to redirect an application's internal HTTP traffic to an     arbitrary proxy server where it may be observed or     manipulated. (CVE-2016-5385)

  - An overflow condition exists in the php_bz2iop_read()     function within file ext/bz2/bz2.c due to improper     handling of error conditions. An unauthenticated, remote     attacker can exploit this, via a crafted request, to     execute arbitrary code. (CVE-2016-5399)

  - A flaw exists in the GD Graphics Library (libgd),     specifically in the gdImageScaleTwoPass() function     within file gd_interpolation.c, due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-6207)

  - An integer overflow condition exists in the     virtual_file_ex() function within file     Zend/zend_virtual_cwd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-6289)

  - A use-after-free error exists within the file     ext/session/session.c when handling 'var_hash'     destruction. An unauthenticated, remote attacker can     exploit this to deference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-6290)

  - An out-of-bounds read error exists in the     exif_process_IFD_in_MAKERNOTE() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     disclose memory contents. (CVE-2016-6291)

  - A NULL pointer dereference flaw exists in the     exif_process_user_comment() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2016-6292)

  - Multiple out-of-bounds read errors exist in the     locale_accept_from_http() function within file     ext/intl/locale/locale_methods.c. An unauthenticated,     remote attacker can exploit these to cause a denial of     service condition or disclose memory contents.
    (CVE-2016-6293, CVE-2016-6294)

  - A use-after-free error exists within file     ext/snmp/snmp.c when handling garbage collection during     deserialization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-6295)

  - A heap-based buffer overflow condition exists in the     simplestring_addn() function within file simplestring.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6296)

  - An integer overflow condition exists in the     php_stream_zip_opener() function within file     ext/zip/zip_stream.c due to improper validation of     user-supplied input when handling zip streams. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6297)

  - An out-of-bounds read error exists in the GD Graphics     Library (libgd), specifically in the     gdImageScaleBilinearPalette() function within file     gd_interpolation.c, when handling transparent color. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose     memory contents.

  - A heap-based buffer overflow condition exists in the     mdecrypt_generic() function within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code.

  - A NULL write flaw exists in the GD Graphics Library     (libgd) in the gdImageColorTransparent() function due to     improper handling of negative transparent colors. A     remote attacker can exploit this to disclose memory     contents.

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.38. It is, therefore, affected by multiple vulnerabilities :

  - A Segfault condition occurs when accessing     nvarchar(max) defined columns. (CVE-2015-8879)

  - A man-in-the-middle vulnerability exists, known as     'httpoxy', due to a failure to properly resolve     namespace conflicts in accordance with RFC 3875 section     4.1.18. The HTTP_PROXY environment variable is set based     on untrusted user data in the 'Proxy' header of HTTP     requests. The HTTP_PROXY environment variable is used by     some web client libraries to specify a remote proxy     server. An unauthenticated, remote attacker can exploit     this, via a crafted 'Proxy' header in an HTTP request,     to redirect an application's internal HTTP traffic to an     arbitrary proxy server where it may be observed or     manipulated. (CVE-2016-5385)

  - An overflow condition exists in the php_bz2iop_read()     function within file ext/bz2/bz2.c due to improper     handling of error conditions. An unauthenticated, remote     attacker can exploit this, via a crafted request, to     execute arbitrary code. (CVE-2016-5399)

  - A flaw exists in the GD Graphics Library (libgd),     specifically in the gdImageScaleTwoPass() function     within file gd_interpolation.c, due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition. (CVE-2016-6207)

  - A buffer overflow condition exists in the     php_url_parse_ex() function. (CVE-2016-6288)

  - An integer overflow condition exists in the     virtual_file_ex() function within file     Zend/zend_virtual_cwd.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-6289)

  - A use-after-free error exists within the file     ext/session/session.c when handling 'var_hash'     destruction. An unauthenticated, remote attacker can     exploit this to deference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-6290)

  - An out-of-bounds read error exists in the     exif_process_IFD_in_MAKERNOTE() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     disclose memory contents. (CVE-2016-6291)

  - A NULL pointer dereference flaw exists in the     exif_process_user_comment() function within file     ext/exif/exif.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2016-6292)

  - Multiple out-of-bounds read errors exist in the     locale_accept_from_http() function within file     ext/intl/locale/locale_methods.c. An unauthenticated,     remote attacker can exploit these to cause a denial of     service condition or disclose memory contents.
    (CVE-2016-6293, CVE-2016-6294)

  - A use-after-free error exists within file     ext/snmp/snmp.c when handling garbage collection during     deserialization of user-supplied input. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-6295)

  - A heap-based buffer overflow condition exists in the     simplestring_addn() function within file simplestring.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6296)

  - An integer overflow condition exists in the     php_stream_zip_opener() function within file     ext/zip/zip_stream.c due to improper validation of     user-supplied input when handling zip streams. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-6297)

  - An out-of-bounds read error exists in the GD Graphics     Library (libgd), specifically in the     gdImageScaleBilinearPalette() function within file     gd_interpolation.c, when handling transparent color. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or disclose     memory contents.

  - A heap-based buffer overflow condition exists in the     mdecrypt_generic() function within file     ext/mcrypt/mcrypt.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a denial of service condition     or the execution of arbitrary code.

  - A NULL write flaw exists in the GD Graphics Library     (libgd) in the gdImageColorTransparent() function due to     improper handling of negative transparent colors. A     remote attacker can exploit this to disclose memory     contents.

  - An overflow condition exists in the php_url_prase_ex()     function due to improper validation of user-supplied     input. A remote attacker can exploit this to cause a     buffer overflow, resulting in a denial of service     condition.

ID	Name	Product	Family	Severity
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	critical
132184	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	Nessus	Huawei Local Security Checks	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	critical
129178	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-1984)	Nessus	Huawei Local Security Checks	critical
98855	PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)	Web App Scanning	Component Vulnerability	critical
98814	PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)	Web App Scanning	Component Vulnerability	critical
120000	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:1717-1)	Nessus	SuSE Local Security Checks	critical
119999	SUSE SLES12 Security Update : php5 (SUSE-SU-2017:1662-1)	Nessus	SuSE Local Security Checks	critical
101287	openSUSE Security Update : php7 (openSUSE-2017-790)	Nessus	SuSE Local Security Checks	critical
101219	openSUSE Security Update : php5 (openSUSE-2017-764)	Nessus	SuSE Local Security Checks	critical
100866	SUSE SLES11 Security Update : php53 (SUSE-SU-2017:1585-1)	Nessus	SuSE Local Security Checks	critical
95421	GLSA-201611-22 : PHP: Multiple vulnerabilities (httpoxy)	Nessus	Gentoo Local Security Checks	critical
9620	Mac OS X 10.x < 10.12 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
93685	macOS < 10.12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
93568	Debian DLA-628-1 : php5 security update	Nessus	Debian Local Security Checks	critical
9460	PHP 5.5.x < 5.5.38 / 5.6.x < 5.6.24 / 7.0.x < 7.0.9 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
92699	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3045-1)	Nessus	Ubuntu Local Security Checks	critical
92574	FreeBSD : php -- multiple vulnerabilities (b6402385-533b-11e6-a7bd-14dae9d210b8) (httpoxy)	Nessus	FreeBSD Local Security Checks	critical
92573	Debian DSA-3631-1 : php5 - security update (httpoxy)	Nessus	Debian Local Security Checks	critical
92556	PHP 7.0.x < 7.0.9 Multiple Vulnerabilities (httpoxy)	Nessus	CGI abuses	critical
92555	PHP 5.6.x < 5.6.24 Multiple Vulnerabilities (httpoxy)	Nessus	CGI abuses	critical
92554	PHP 5.5.x < 5.5.38 Multiple Vulnerabilities (httpoxy)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2016-6294

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical