In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Heap-based buffer over-read in mbstring regular expression functions (CVE-2019-9023)

  - Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to     hijack web sessions by specifying a session ID. (CVE-2011-4718)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - php: buffer overflow in handling of long link names in tar phar archives (CVE-2016-2554)

  - php: Uninitialized read in exif_process_IFD_in_TIFF (CVE-2019-9641)

  - The ip2long function in PHP 5.1.4 and earlier may incorrectly validate an arbitrary string and return a     valid network IP address, which allows remote attackers to obtain network information and facilitate other     attacks, as demonstrated using SQL injection in the X-FORWARDED-FOR Header in index.php in MiniBB 2.0.
    NOTE: it could be argued that the ip2long behavior represents a risk for security-relevant issues in a way     that is similar to strcpy's role in buffer overflows, in which case this would be a class of     implementation bugs that would require separate CVE items for each PHP application that uses ip2long in a     security-relevant manner. (CVE-2006-4023)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:1296 advisory.

  - php: Heap overflow in mysqlnd when not receiving UNSIGNED_FLAG in BIT field (CVE-2016-7412)

  - php: Use after free in wddx_deserialize (CVE-2016-7413)

  - php: Out of bounds heap read when verifying signature of zip phar in phar_parse_zipfile (CVE-2016-7414)

  - php: Stack based buffer overflow in msgfmt_format_message (CVE-2016-7416)

  - php: Missing type check when unserializing SplArray (CVE-2016-7417)

  - php: Null pointer dereference in php_wddx_push_element (CVE-2016-7418)

  - php: Use-after-free vulnerability when resizing the 'properties' hash table of a serialized object     (CVE-2016-7479)

  - php, gd: Stack overflow in gdImageFillToBorder on truecolor images (CVE-2016-9933)

  - php: NULL Pointer Dereference in WDDX Packet Deserialization with PDORow (CVE-2016-9934)

  - php: Invalid read when wddx decodes empty boolean element (CVE-2016-9935)

  - php: Use After Free in unserialize() (CVE-2016-9936)

  - php: Wrong calculation in exif_convert_any_to_int function (CVE-2016-10158)

  - php: Integer overflow in phar_parse_pharfile (CVE-2016-10159)

  - php: Off-by-one error in phar_parse_pharfile when loading crafted phar archive (CVE-2016-10160)

  - php: Out-of-bounds heap read on unserialize in finish_nested_data() (CVE-2016-10161)

  - php: Null pointer dereference when unserializing PHP object (CVE-2016-10162)

  - gd: DoS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)

  - gd: Integer overflow in gd_io.c (CVE-2016-10168)

  - php: Use of uninitialized memory in unserialize() (CVE-2017-5340)

  - php: Buffer over-read from unitialized data in gdImageCreateFromGifCtx function (CVE-2017-7890)

  - oniguruma: Out-of-bounds stack read in match_at() during regular expression searching (CVE-2017-9224)

  - oniguruma: Heap buffer overflow in next_state_val() during regular expression compilation (CVE-2017-9226)

  - oniguruma: Out-of-bounds stack read in mbc_enc_len() during regular expression searching (CVE-2017-9227)

  - oniguruma: Out-of-bounds heap write in bitset_set_range() (CVE-2017-9228)

  - oniguruma: Invalid pointer dereference in left_adjust_char_head() (CVE-2017-9229)

  - php: Incorrect WDDX deserialization of boolean parameters leads to DoS (CVE-2017-11143)

  - php: Incorrect return value check of OpenSSL sealing function leads to crash (CVE-2017-11144)

  - php: wddx_deserialize() heap out-of-bound read via php_parse_date() (CVE-2017-11145)

  - php: Out-of-bounds read in phar_parse_pharfile (CVE-2017-11147)

  - php: Stack-based buffer over-read in msgfmt_parse_message function (CVE-2017-11362)

  - php: Stack based 1-byte buffer over-write in zend_ini_do_op() function Zend/zend_ini_parser.c     (CVE-2017-11628)

  - php: Heap use after free in ext/standard/var_unserializer.re (CVE-2017-12932)

  - php: buffer over-read in finish_nested_data function (CVE-2017-12933)

  - php: heap use after free in ext/standard/var_unserializer.re (CVE-2017-12934)

  - php: Out-of-bound read in timelib_meridian() (CVE-2017-16642)

  - gd: Infinite loop in gdImageCreateFromGifCtx() in gd_gif_in.c (CVE-2018-5711)

  - php: Reflected XSS on PHAR 404 page (CVE-2018-5712)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ext/standard/var_unserializer.c in PHP before 5.6.25     and 7.x before 7.0.10 mishandles certain invalid     objects, which allows remote attackers to cause a     denial of service or possibly have unspecified other     impact via crafted serialized data that leads to a (1)
    __destruct call or (2) magic method     call.(CVE-2016-7124)

  - Stack-based buffer overflow in ext/phar/tar.c in PHP     before 5.5.32, 5.6.x before 5.6.18, and 7.x before     7.0.3 allows remote attackers to cause a denial of     service (application crash) or possibly have     unspecified other impact via a crafted TAR     archive.(CVE-2016-2554)

  - A flaw was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-6831)

  - The sapi_header_op function in main/SAPI.c in PHP     before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before     5.6.6 supports deprecated line folding without     considering browser compatibility, which allows remote     attackers to conduct cross-site scripting (XSS) attacks     against Internet Explorer by leveraging (1) %0A%20 or     (2) %0D%0A%20 mishandling in the header     function.(CVE-2015-8935)

  - The openssl_random_pseudo_bytes function in     ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x     before 5.5.28, and 5.6.x before 5.6.12 incorrectly     relies on the deprecated RAND_pseudo_bytes function,     which makes it easier for remote attackers to defeat     cryptographic protection mechanisms via unspecified     vectors.(CVE-2015-8867)

  - Use-after-free vulnerability in the SPL unserialize     implementation in ext/spl/spl_array.c in PHP before     5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12     allows remote attackers to execute arbitrary code via     crafted serialized data that triggers misuse of an     array field.(CVE-2015-6832)

  - Directory traversal vulnerability in the PharData class     in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x     before 5.6.12 allows remote attackers to write to     arbitrary files via a .. (dot dot) in a ZIP archive     entry that is mishandled during an extractTo     call.(CVE-2015-6833)

  - Directory traversal vulnerability in the     ZipArchive::extractTo function in ext/zip/php_zip.c in     PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x     before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before     3.12.1 allows remote attackers to create arbitrary     empty directories via a crafted ZIP     archive.(CVE-2014-9767)

  - The ZIP signature-verification feature in PHP before     5.6.26 and 7.x before 7.0.11 does not ensure that the     uncompressed_filesize field is large enough, which     allows remote attackers to cause a denial of service     (out-of-bounds memory access) or possibly have     unspecified other impact via a crafted PHAR archive,     related to ext/phar/util.c and     ext/phar/zip.c.(CVE-2016-7414)

  - ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before     7.0.13 allows remote attackers to cause a denial of     service (NULL pointer dereference) via crafted     serialized data in a wddxPacket XML document, as     demonstrated by a PDORow string.(CVE-2016-9934)

  - The php_wddx_push_element function in ext/wddx/wddx.c     in PHP before 5.6.29 and 7.x before 7.0.14 allows     remote attackers to cause a denial of service     (out-of-bounds read and memory corruption) or possibly     have unspecified other impact via an empty boolean     element in a wddxPacket XML document.(CVE-2016-9935)

  - In PHP before 5.6.31, an invalid free in the WDDX     deserialization of boolean parameters could be used by     attackers able to inject XML for deserialization to     crash the PHP interpreter, related to an invalid free     for an empty boolean element in     ext/wddx/wddx.c.(CVE-2017-11143)

  - Integer overflow in the php_html_entities function in     ext/standard/html.c in PHP before 5.5.36 and 5.6.x     before 5.6.22 allows remote attackers to cause a denial     of service or possibly have unspecified other impact by     triggering a large output string from the     htmlspecialchars function.(CVE-2016-5094)

  - The get_icu_value_internal function in     ext/intl/locale/locale_methods.c in PHP before 5.5.36,     5.6.x before 5.6.22, and 7.x before 7.0.7 does not     ensure the presence of a '\0' character, which allows     remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a crafted locale_get_primary_language     call.(CVE-2016-5093)

  - The grapheme_strpos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4541)

  - The exif_process_IFD_TAG function in ext/exif/exif.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 does not properly construct spprintf arguments,     which allows remote attackers to cause a denial of     service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4542)

  - The phar_parse_zipfile function in zip.c in the PHAR     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service     (out-of-bounds read and application crash) by placing a     PK\x05\x06 signature at an invalid     location.(CVE-2016-3142)

  - ** DISPUTED ** Integer overflow in the     php_raw_url_encode function in ext/standard/url.c in     PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before     7.0.5 allows remote attackers to cause a denial of     service (application crash) via a long string to the     rawurlencode function. NOTE: the vendor says 'Not sure     if this qualifies as security issue (probably     not).'(CVE-2016-4070)

  - The xml_parse_into_struct function in ext/xml/xml.c in     PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before     7.0.6 allows remote attackers to cause a denial of     service (buffer under-read and segmentation fault) or     possibly have unspecified other impact via crafted XML     data in the second argument, leading to a parser level     of zero.(CVE-2016-4539)

  - The grapheme_stripos function in     ext/intl/grapheme/grapheme_string.c in PHP before     5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6     allows remote attackers to cause a denial of service     (out-of-bounds read) or possibly have unspecified other     impact via a negative offset.(CVE-2016-4540)

  - Use-after-free vulnerability in wddx.c in the WDDX     extension in PHP before 5.5.33 and 5.6.x before 5.6.19     allows remote attackers to cause a denial of service     (memory corruption and application crash) or possibly     have unspecified other impact by triggering a     wddx_deserialize call on XML data containing a crafted     var element.(CVE-2016-3141)

  - In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR     archive handler could be used by attackers supplying     malicious archive files to crash the PHP interpreter or     potentially disclose information due to a buffer     over-read in the phar_parse_pharfile function in     ext/phar/phar.c.(CVE-2017-11147)

  - The exif_process_IFD_in_JPEG function in     ext/exif/exif.c in PHP before 5.5.35, 5.6.x before     5.6.21, and 7.x before 7.0.6 does not validate IFD     sizes, which allows remote attackers to cause a denial     of service (out-of-bounds read) or possibly have     unspecified other impact via crafted header     data.(CVE-2016-4543)

  - The odbc_bindcols function in ext/odbc/php_odbc.c in     PHP before 5.6.12 mishandles driver behavior for     SQL_WVARCHAR columns, which allows remote attackers to     cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table.(CVE-2015-8879)

  - An issue was discovered in Oniguruma 6.2.0, as used in     Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP     through 7.1.5. A heap out-of-bounds write or read     occurs in next_state_val() during regular expression     compilation. Octal numbers larger than 0xff are not     handled correctly in fetch_token() and     fetch_token_in_cc(). A malformed regular expression     containing an octal number in the form of '\700' would     produce an invalid code point value larger than 0xff in     next_state_val(), resulting in an out-of-bounds write     memory corruption.(CVE-2017-9226)

  - In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x     before 7.1.7, the openssl extension PEM sealing code     did not check the return value of the OpenSSL sealing     function, which could lead to a crash of the PHP     interpreter, related to an interpretation conflict for     a negative number in ext/openssl/openssl.c, and an     OpenSSL documentation omission.(CVE-2017-11144)

  - The make_http_soap_request function in     ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before     5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4     allows remote attackers to obtain sensitive information     from process memory or cause a denial of service (type     confusion and application crash) via crafted serialized
    _cookies data, related to the SoapClient::__call method     in ext/soap/soap.c.(CVE-2016-3185)

  - The object_common1 function in     ext/standard/var_unserializer.c in PHP before 5.6.30,     7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows     remote attackers to cause a denial of service (buffer     over-read and application crash) via crafted serialized     data that is mishandled in a finish_nested_data     call.(CVE-2016-10161)

  - The finish_nested_data function in     ext/standard/var_unserializer.re in PHP before 5.6.31,     7.0.x before 7.0.21, and 7.1.x before 7.1.7 is prone to     a buffer over-read while unserializing untrusted data.
    Exploitation of this issue can have an unspecified     impact on the integrity of PHP.(CVE-2017-12933)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.1. It is, therefore, affected by the following vulnerabilities :

 - A use-after-free error exists that is triggered when handling unserialized object properties. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2016-7479)

 - An integer overflow condition exists in the _zend_hash_init() function in zend_hash.c due to improper validation of unserialized objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-5340)

 - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158)

 - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161)

 - A NULL pointer dereference flaw exists in the php_wddx_pop_element() function in wddx.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10162)

 - An signed integer overflow condition exists in gd_io.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact. (CVE-2016-10168)

 - A denial of service vulnerability exists in the bundled GD Graphics Library (LibGD) in the gdImageCreateFromGd2Ctx() function in gd_gd2.c due to improper validation of images. An unauthenticated, remote attacker can exploit this, via a specially crafted image, to crash the process. (CVE-2016-10167)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.15. It is, therefore, affected by the following vulnerabilities :

 - A remote code execution vulnerability exists due to a use-after-free error in the unserialize() function that is triggered when using DateInterval input. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in a denial of service condition or the execution of arbitrary code. (CVE-2015-2787)

 - A use-after-free error exists that is triggered when handling unserialized object properties. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary code. (CVE-2016-7479)

 - An integer overflow condition exists in the _zend_hash_init() function in zend_hash.c due to improper validation of unserialized objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2017-5340)

 - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158)

 - An integer overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper validation when handling phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10159)

 - An off-by-one overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10160)

 - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161)

 - A NULL pointer dereference flaw exists in the php_wddx_pop_element() function in wddx.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10162)

 - An signed integer overflow condition exists in gd_io.c due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to have an unspecified impact.

 - A type confusion flaw exists that is triggered during the deserialization of specially crafted GMP objects. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition.

 - A type confusion error exists that is triggered when deserializing ZVAL objects. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

 - An out-of-bounds read error exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition.

 - A denial of service vulnerability exists in the bundled GD Graphics Library (LibGD) in the gdImageCreateFromGd2Ctx() function in gd_gd2.c due to improper validation of images. An unauthenticated, remote attacker can exploit this, via a specially crafted image, to crash the process.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.30. It is, therefore, affected by the following vulnerabilities :

 - A floating pointer exception flaw exists in the exif_convert_any_to_int() function in exif.c that is triggered when handling TIFF and JPEG image tags. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10158)

 - An integer overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper validation when handling phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10159)

 - An off-by-one overflow condition exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition. (CVE-2016-10160)

 - An out-of-bounds read error exists in the finish_nested_data() function in var_unserializer.c due to improper validation of unserialized data. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition or the disclosure of memory contents. (CVE-2016-10161)

 - An out-of-bounds read error exists in the phar_parse_pharfile() function in phar.c due to improper parsing of phar archives. An unauthenticated, remote attacker can exploit this to cause a crash, resulting in a denial of service condition.

 - A denial of service vulnerability exists in the bundled GD Graphics Library (LibGD) in the gdImageCreateFromGd2Ctx() function in gd_gd2.c due to improper validation of images. An unauthenticated, remote attacker can exploit this, via a specially crafted image, to crash the process.

Note that the scanner has not attempted to exploit this issue but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11143: An invalid free in the WDDX     deserialization of booleanparameters could be used by     attackers able to inject XML for deserialization tocrash     the PHP interpreter. (bsc#1048097)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting could lead to heap overflow (bsc#986386)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from unitialized data in     gdImageCreateFromGifCtx function could lead to denial of     service (bsc#1050241)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11142: Remoteattackers could cause a CPU     consumption denial of service attack by injectinglong     form variables, related to main/php_variables.
    (bsc#1048100)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() could lead to denial of service     (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from unitialized data in     gdImageCreateFromGifCtx function could lead to denial of     service (bsc#1050241)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting in heap overflow could lead to denial of     service or code execution (bsc#986386) Other fixes :

  - Soap Request with References (bsc#1053645)

  - php7-pear should explicitly require     php7-pear-Archive_Tar otherwise this dependency must be     declared in every php7-pear-* package explicitly.
    [bnc#1052389]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php53 fixes the several issues. These security issues were fixed :

  - CVE-2017-12933: The finish_nested_data function in     ext/standard/var_unserializer.re was prone to a buffer     over-read while unserializing untrusted data.
    Exploitation of this issue could have had an unspecified     impact on the integrity of PHP (bsc#1054430).

  - CVE-2017-11628: Stack-based buffer overflow in the     zend_ini_do_op() function in Zend/zend_ini_parser.c     could have caused a denial of service or potentially     allowed executing code (bsc#1050726).

  - CVE-2017-7890: The GIF decoding function     gdImageCreateFromGifCtx in the GD Graphics Library did     not zero colorMap arrays use. A specially crafted GIF     image could use the uninitialized tables to read ~700     bytes from the top of the stack, potentially disclosing     sensitive information (bsc#1050241).

  - CVE-2016-5766: Integer overflow in the _gd2GetHeader in     the GD Graphics Library (aka libgd) allowed remote     attackers to cause a denial of service (heap-based     buffer overflow and application crash) or possibly have     unspecified other impact via crafted chunk dimensions in     an image (bsc#986386).

  - CVE-2017-11145: An error in the date extension's     timelib_meridian parsing code could have been used by     attackers able to supply date strings to leak     information from the interpreter, related to     ext/date/lib/parse_date.c out-of-bounds reads affecting     the php_parse_date function (bsc#1048112).

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could have lead to     information leak [bsc#1048111]

  - CVE-2016-10397: Incorrect handling of various URI     components in the URL parser could have been used by     attackers to bypass hostname-specific URL checks     (bsc#1047454).

  - CVE-2017-11147: The PHAR archive handler could have been     used by attackers supplying malicious archive files to     crash the PHP interpreter or potentially disclose     information due to a buffer over-read in the     phar_parse_pharfile function (bsc#1048094).

  - CVE-2017-11144: The openssl extension PEM sealing code     did not check the return value of the OpenSSL sealing     function, which could have lead to a crash of the PHP     interpreter (bsc#1048096).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11143: An invalid free in the WDDX     deserialization of booleanparameters could be used by     attackers able to inject XML for deserialization tocrash     the PHP interpreter. (bsc#1048097)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting could lead to heap overflow (bsc#986386)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() in Zend/zend_ini_parser.c (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from uninitialized data     in gdImageCreateFromGifCtx function could lead to denial     of service (bsc#1050241)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php7 fixes the following issues :

  - CVE-2016-10397: parse_url() can be bypassed to return     fake host. (bsc#1047454)

  - CVE-2017-11142: Remoteattackers could cause a CPU     consumption denial of service attack by injectinglong     form variables, related to main/php_variables.
    (bsc#1048100)

  - CVE-2017-11144: The opensslextension PEM sealing code     did not check the return value of the OpenSSL     sealingfunction, which could lead to a crash.
    (bsc#1048096)

  - CVE-2017-11145: Lack of bounds checks in     timelib_meridian coud lead to information leak.
    (bsc#1048112)

  - CVE-2017-11146: Lack of bounds checks in     timelib_meridian parse code could lead to information     leak. (bsc#1048111)

  - CVE-2017-11147: The PHAR archive handler could beused by     attackers supplying malicious archive files to crash the     PHP interpreteror potentially disclose information.
    (bsc#1048094)

  - CVE-2017-11628: Stack-base dbuffer overflow in     zend_ini_do_op() could lead to denial of service     (bsc#1050726)

  - CVE-2017-7890: Buffer over-read from uninitialized data     in gdImageCreateFromGifCtx function could lead to denial     of service (bsc#1050241)

  - CVE-2016-5766: Integer Overflow in _gd2GetHeader()     resulting in heap overflow could lead to denial of     service or code execution (bsc#986386)

Other fixes :

  - Soap Request with References (bsc#1053645)

  - php7-pear should explicitly require     php7-pear-Archive_Tar otherwise this dependency must be     declared in every php7-pear-* package explicitly.
    [bnc#1052389]

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3382-1 advisory.

    It was discovered that the PHP opcache created keys for files it cached based on their filepath. A local     attacker could possibly use this issue in a shared hosting environment to obtain sensitive information.
    This issue only affected Ubuntu 14.04 LTS. (CVE-2015-8994)

    It was discovered that the PHP URL parser incorrectly handled certain URI components. A remote attacker     could possibly use this issue to bypass hostname-specific URL checks. This issue only affected Ubuntu     14.04 LTS. (CVE-2016-10397)

    It was discovered that PHP incorrectly handled certain boolean parameters when unserializing data. A     remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service.
    This issue only affected Ubuntu 14.04 LTS. (CVE-2017-11143)

    Sebastian Li, Wei Lei, Xie Xiaofei, and Liu Yang discovered that PHP incorrectly handled the OpenSSL     sealing function. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a     denial of service. (CVE-2017-11144)

    Wei Lei and Liu Yang discovered that the PHP date extension incorrectly handled memory. A remote attacker     could possibly use this issue to disclose sensitive information from the server. (CVE-2017-11145)

    It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this     issue to cause PHP to crash or disclose sensitive information. This issue only affected Ubuntu 14.04 LTS.
    (CVE-2017-11147)

    It was discovered that PHP incorrectly handled locale length. A remote attacker could possibly use this     issue to cause PHP to crash, resulting in a denial of service. (CVE-2017-11362)

    Wei Lei and Liu Yang discovered that PHP incorrectly handled parsing ini files. An attacker could possibly     use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2017-11628)

    It was discovered that PHP mbstring incorrectly handled certain regular expressions. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several issues have been discovered in PHP (recursive acronym for PHP:
Hypertext Preprocessor), a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

CVE-2016-10397 Incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks.

CVE-2017-11143 An invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP interpreter.

CVE-2017-11144 The openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter.

CVE-2017-11145 Lack of a bounds check in the date extension's timelib_meridian parsing code could be used by attackers able to supply date strings to leak information from the interpreter.

CVE-2017-11147 The PHAR archive handler could be used by attackers supplying malicious archive files to crash the PHP interpreter or potentially disclose information due to a buffer over-read in the phar_parse_pharfile function in ext/phar/phar.c.

For Debian 7 'Wheezy', these problems have been fixed in version 5.4.45-0+deb7u9.

We recommend that you upgrade your php5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP :

  - A seg fault when loading hostile phar could be used     to crash the PHP interpreter or potentially disclose     information due to a buffer over-read in the     phar_parse_pharfile function in ext/phar/phar.c.
    (CVE-2017-11147)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An integer overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     validation when handling phar archives. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10159)

  - An off-by-one overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2016-10160)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process.

  - The gdImageCreateFromGd2Ctx function in gd_gd2.c in the     GD Graphics Library could allow a remote attacker to     cause a denial of service via a crafted image file.
    (CVE-2016-10167)

  - An integer overflow in gd_io.c in the GD Graphics     Library before could allow a remote attacker to have     an unspecified impact on PHP. (CVE-2016-10168)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.1.x prior to 7.1.1. It is, therefore, affected by the following vulnerabilities :

  - A use-after-free error exists that is triggered when     handling unserialized object properties. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-7479)

  - An integer overflow condition exists in the
    _zend_hash_init() function in zend_hash.c due to     improper validation of unserialized objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5340)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - A NULL pointer dereference flaw exists in the     php_wddx_pop_element() function in wddx.c due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10162)

  - An signed integer overflow condition exists in gd_io.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process. (CVE-2016-10167)

   - An integer overflow condition exists in the gd_io.c      script of the GD Graphics Library (libgd). An      unauthenticated, remote attacker can exploit this to      cause a denial of service condition or the execution of      arbitrary code. (CVE-2016-10168)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2017-11147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.15. It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists due to a     use-after-free error in the unserialize() function that     is triggered when using DateInterval input. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in a denial     of service condition or the execution of arbitrary code.
    (CVE-2015-2787)

  - A use-after-free error exists that is triggered when     handling unserialized object properties. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary code.
    (CVE-2016-7479)

  - An integer overflow condition exists in the
    _zend_hash_init() function in zend_hash.c due to     improper validation of unserialized objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-5340)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An integer overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     validation when handling phar archives. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10159)

  - An off-by-one overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2016-10160)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - A NULL pointer dereference flaw exists in the     php_wddx_pop_element() function in wddx.c due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10162)

  - An signed integer overflow condition exists in gd_io.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A type confusion flaw exists that is triggered during     the deserialization of specially crafted GMP objects. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition.

  - A type confusion error exists that is triggered when     deserializing ZVAL objects. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process. (CVE-2016-10167)

  - An integer overflow condition exists in the gd_io.c     script of the GD Graphics Library (libgd). An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-10168)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2017-11147)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP running on the remote web server is 5.6.x prior to 5.6.30. It is, therefore, affected by the following vulnerabilities :

  - A seg fault when loading hostile phar could be used     to crash the PHP interpreter or potentially disclose     information due to a buffer over-read in the     phar_parse_pharfile function in ext/phar/phar.c.
    (CVE-2017-11147)

  - A floating pointer exception flaw exists in the     exif_convert_any_to_int() function in exif.c that is     triggered when handling TIFF and JPEG image tags. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10158)

  - An integer overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     validation when handling phar archives. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition. (CVE-2016-10159)

  - An off-by-one overflow condition exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition. (CVE-2016-10160)

  - An out-of-bounds read error exists in the     finish_nested_data() function in var_unserializer.c due     to improper validation of unserialized data. An     unauthenticated, remote attacker can exploit this to     cause a crash, resulting in a denial of service     condition or the disclosure of memory contents.
    (CVE-2016-10161)

  - An out-of-bounds read error exists in the     phar_parse_pharfile() function in phar.c due to improper     parsing of phar archives. An unauthenticated, remote     attacker can exploit this to cause a crash, resulting in     a denial of service condition.

  - A denial of service vulnerability exists in the bundled     GD Graphics Library (LibGD) in the     gdImageCreateFromGd2Ctx() function in gd_gd2.c due to     improper validation of images. An unauthenticated,     remote attacker can exploit this, via a specially     crafted image, to crash the process.

  - The gdImageCreateFromGd2Ctx function in gd_gd2.c in the     GD Graphics Library could allow a remote attacker to     cause a denial of service via a crafted image file.
    (CVE-2016-10167)

  - An integer overflow in gd_io.c in the GD Graphics     Library before could allow a remote attacker to have     an unspecified impact on PHP. (CVE-2016-10168)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198558	RHEL 6 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198511	RHEL 7 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198485	RHEL 5 : php (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194027	RHEL 6 / 7 : rh-php70-php (RHSA-2018:1296)	Nessus	Red Hat Local Security Checks	critical
137966	EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2020-1747)	Nessus	Huawei Local Security Checks	critical
132184	EulerOS 2.0 SP3 : php (EulerOS-SA-2019-2649)	Nessus	Huawei Local Security Checks	critical
131592	EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)	Nessus	Huawei Local Security Checks	critical
130683	EulerOS 2.0 SP5 : php (EulerOS-SA-2019-2221)	Nessus	Huawei Local Security Checks	critical
98856	PHP 7.1.x < 7.1.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98839	PHP 7.0.x < 7.0.15 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
98821	PHP 5.6.x < 5.6.30 Multiple DoS	Web App Scanning	Component Vulnerability	critical
120004	SUSE SLES12 Security Update : php5 (SUSE-SU-2017:2317-1)	Nessus	SuSE Local Security Checks	critical
120003	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:2303-1)	Nessus	SuSE Local Security Checks	critical
103317	SUSE SLES11 Security Update : php53 (SUSE-SU-2017:2522-1)	Nessus	SuSE Local Security Checks	critical
102966	openSUSE Security Update : php5 (openSUSE-2017-1010)	Nessus	SuSE Local Security Checks	critical
102947	openSUSE Security Update : php7 (openSUSE-2017-994)	Nessus	SuSE Local Security Checks	critical
102416	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3382-1)	Nessus	Ubuntu Local Security Checks	critical
101908	Debian DLA-1034-1 : php5 security update	Nessus	Debian Local Security Checks	critical
101050	Tenable SecurityCenter PHP < 5.6.30 Multiple Vulnerabilities (TNS-2017-04)	Nessus	Misc.	critical
96801	PHP 7.1.x < 7.1.1 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96800	PHP 7.0.x < 7.0.15 Multiple Vulnerabilities	Nessus	CGI abuses	critical
96799	PHP 5.6.x < 5.6.30 Multiple DoS	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2017-11147

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical