In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1296 advisory.

  - php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field (CVE-2016-7412)

  - php: Use after free in wddx_deserialize (CVE-2016-7413)

  - php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile (CVE-2016-7414)

  - php: Stack based buffer overflow in msgfmt_format_message (CVE-2016-7416)

  - php: Missing type check when unserializing SplArray (CVE-2016-7417)

  - php: Null pointer dereference in php_wddx_push_element (CVE-2016-7418)

  - php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object     (CVE-2016-7479)

  - php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)

  - php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)

  - php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

  - php: Use After Free in unserialize() (CVE-2016-9936)

  - php: Wrong calculation in exif_convert_any_to_int function (CVE-2016-10158)

  - php: Integer overflow in phar_parse_pharfile (CVE-2016-10159)

  - php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive (CVE-2016-10160)

  - php: Out-of-bounds heap read on unserialize in finish_nested_data() (CVE-2016-10161)

  - php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)

  - gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)

  - gd: Integer overflow in gd_io.c (CVE-2016-10168)

  - php: Use of uninitialized memory in unserialize() (CVE-2017-5340)

  - php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)

  - oniguruma: Out-of-bounds stack read in match_at() during regular expression searching (CVE-2017-9224)

  - oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation (CVE-2017-9226)

  - oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching (CVE-2017-9227)

  - oniguruma: Out-of-bounds heap write in bitset_set_range() (CVE-2017-9228)

  - oniguruma: Invalid pointer dereference in left_adjust_char_head() (CVE-2017-9229)

  - php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)

  - php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)

  - php: wddx_deserialize() heap out-of-bound read via php_parse_date() (CVE-2017-11145)

  - php: Out-of-bounds read in phar_parse_pharfile (CVE-2017-11147)

  - php: Stack-based buffer over-read in msgfmt_parse_message function (CVE-2017-11362)

  - php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c     (CVE-2017-11628)

  - php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

  - php: buffer over-read in finish_nested_data function (CVE-2017-12933)

  - php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12934)

  - php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

  - gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

  - php: Reflected XSS on PHAR 404 page (CVE-2018-5712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.1. It is, therefore, affected by the following vulnerabilities :

 - A use-after-free error exists that is triggered when handling unserialized object properties. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2016-7479)

 - An integer overflow condition exists in the _zend_hash_init() function in zend_hash.c due to improper validation of unserialized objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-5340)

 - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158)

 - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161)

 - A NULL pointer dereference flaw exists in the php_wddx_pop_element() function in wddx.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10162)

 - An signed integer overflow condition exists in gd_io.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact. (CVE-2016-10168)

 - A denial of service vulnerability exists in the bundled GD Graphics Library (LibGD) in the gdImageCreateFromGd2Ctx() function in gd_gd2.c due to improper validation of images. An unauthenticated, remote attacker can exploit this, via a specially crafted image, to crash the process. (CVE-2016-10167)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.15. It is, therefore, affected by the following vulnerabilities :

 - A remote code execution vulnerability exists due to a use-after-free error in the unserialize() function that is triggered when using DateInterval input. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2787)

 - A use-after-free error exists that is triggered when handling unserialized object properties. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2016-7479)

 - An integer overflow condition exists in the _zend_hash_init() function in zend_hash.c due to improper validation of unserialized objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-5340)

 - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158)

 - An integer overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper validation when handling phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10159)

 - An off-by-one overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10160)

 - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161)

 - A NULL pointer dereference flaw exists in the php_wddx_pop_element() function in wddx.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10162)

 - An signed integer overflow condition exists in gd_io.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

 - A type confusion flaw exists that is triggered during the deserialization of specially crafted GMP objects. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition.

 - A type confusion error exists that is triggered when deserializing ZVAL objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - An out-of-bounds read error exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition.

 - A denial of service vulnerability exists in the bundled GD Graphics Library (LibGD) in the gdImageCreateFromGd2Ctx() function in gd_gd2.c due to improper validation of images. An unauthenticated, remote attacker can exploit this, via a specially crafted image, to crash the process.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vectors involving the number of horizontal and vertical chunks in an image. (CVE-2016-10168)

In all versions of PHP 7, during the unserialization process, resizing the 'properties'; hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain arbitrary code execution. (CVE-2016-7479)

The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call. (CVE-2016-10161)

Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch. (CVE-2016-10160)

The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call. (CVE-2016-10162)

It was found that the exif_convert_any_to_int() function in PHP was vulnerable to floating point exceptions when parsing tags in image files. A remote attacker with the ability to upload a malicious image could crash PHP, causing a Denial of Service. (CVE-2016-10158)

Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
(CVE-2016-10159)

The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted image file.
(CVE-2016-10167)

Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.(CVE-2017-5340)

Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

CVE-2016-7478: Zend/zend_exceptions.c in PHP allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876.

CVE-2016-7479: During the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote attacker may exploit this bug to gain the ability of arbitrary code execution. Even though the property table issue only affects PHP 7 this change also prevents a wide range of other __wakeup() based attacks.

CVE-2017-7272: The fsockopen() function will use the port number which is defined in hostname instead of the port number passed to the second parameter of the function. This misbehavior may introduce another attack vector for an already known application vulnerability (e.g.
Server Side Request Forgery).

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u8.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3211-1 advisory.

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-7479)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-9137)

    It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-9935)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-9936)

    It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

    It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this     issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

    It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-10160)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

    It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10162)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2017-5340)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3196-1 advisory.

    It was discovered that PHP incorrectly handled certain arguments to the locale_get_display_name function.
    A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2014-9912)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2016-7478)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-7479)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only applied to Ubuntu 14.04 LTS. (CVE-2016-9137)

    It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-9934)

    It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-9935)

    It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue     to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

    It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this     issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

    It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-10160)

    It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.1. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists that is triggered when     handling unserialized object properties. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-7479)

  - An integer overflow condition exists in the
    _zend_hash_init() function in zend_hash.c due to     improper validation of unserialized objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5340)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - A NULL pointer dereference flaw exists in the     php_wddx_pop_element() function in wddx.c due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10162)

  - An signed integer overflow condition exists in gd_io.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process. (CVE-2016-10167)

   - An integer overflow condition exists in the gd_io.c      script of the GD Graphics Library (libgd). An      unauthenticated, remote attacker can exploit this to      cause a denial of service condition or the execution of      arbitrary code. (CVE-2016-10168)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2017-11147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.15. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to a     use-after-free error in the unserialize() function that     is triggered when using DateInterval input. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2015-2787)

  - A use-after-free error exists that is triggered when     handling unserialized object properties. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-7479)

  - An integer overflow condition exists in the
    _zend_hash_init() function in zend_hash.c due to     improper validation of unserialized objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5340)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An integer overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     validation when handling phar archives. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10159)

  - An off-by-one overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2016-10160)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - A NULL pointer dereference flaw exists in the     php_wddx_pop_element() function in wddx.c due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10162)

  - An signed integer overflow condition exists in gd_io.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A type confusion flaw exists that is triggered during     the deserialization of specially crafted GMP objects. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition.

  - A type confusion error exists that is triggered when     deserializing ZVAL objects. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process. (CVE-2016-10167)

  - An integer overflow condition exists in the gd_io.c     script of the GD Graphics Library (libgd). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-10168)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2017-11147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Check Point reports :

... discovered 3 fresh and previously unknown vulnerabilities (CVE-2016-7479, CVE-2016-7480, CVE-2016-7478) in the PHP 7 unserialize mechanism.

The first two vulnerabilities allow attackers to take full control over servers, allowing them to do anything they want with the website, from spreading malware to defacing it or stealing customer data.

The last vulnerability generates a Denial of Service attack which basically hangs the website, exhausts its memory consumption, and shuts it down.

The PHP security team issued fixes for two of the vulnerabilities on the 13th of October and 1st of December.

Versions of PHP prior to 7.1.0 are vulnerable to the following issues :

 - A flaw exists that is due to 'parse_url' returning the incorrect host. This may allow a remote attacker to have an impact that may include bypassing authentication, or conducting open redirection and server-side request forgery attacks, depending on how the function is implemented.
 - An overflow condition exists in the 'dynamicGetbuf()' function in 'gd_io_dp.c'. The issue is triggered as certain input is not properly validated. With a specially crafted string, a remote attacker can cause a stack-based buffer overflow, resulting in a denial of service in a process utilizing the language or potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the 'unserialize()' function related to uses of '__wakeup' which modify properties. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error exists that is triggered when handling unserialized object properties. With a specially crafted request, a remote attacker can dereference already freed memory and potentially execute arbitrary code. 

ID	Name	Product	Family	Severity
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196189	RHEL 7 : php (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196157	RHEL 6 : php (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196137	RHEL 5 : php (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
194027	RHEL 6 / 7 : rh-php70-php (RHSA-2018:1296)	Nessus	Red Hat Local Security Checks	critical
98856	PHP 7.1.x < 7.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98839	PHP 7.0.x < 7.0.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
119993	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0534-1)	Nessus	SuSE Local Security Checks	critical
99039	Amazon Linux AMI : php70 (ALAS-2017-812)	Nessus	Amazon Linux Local Security Checks	critical
99003	Debian DLA-875-1 : php5 security update	Nessus	Debian Local Security Checks	critical
97563	openSUSE Security Update : php7 (openSUSE-2017-304)	Nessus	SuSE Local Security Checks	critical
97384	Ubuntu 16.04 LTS : PHP vulnerabilities (USN-3211-1)	Nessus	Ubuntu Local Security Checks	critical
97190	Ubuntu 14.04 LTS : PHP vulnerabilities (USN-3196-1)	Nessus	Ubuntu Local Security Checks	critical
96801	PHP 7.1.x < 7.1.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96800	PHP 7.0.x < 7.0.15 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96292	FreeBSD : PHP -- multiple vulnerabilities (1b61ecef-cdb9-11e6-a9a5-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	critical
9843	PHP < 7.1.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	critical

Detections

Analytics

CVE-2016-7479

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical