RHEL 6 / 7 : php54 (RHSA-2015:1066)

critical Nessus Plugin ID 193682

Language:

Synopsis

The remote Red Hat host is missing one or more security updates for php54.

Description

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. The php54 packages provide a recent stable release of PHP with the PEAR 1.9.4, APC 3.1.15, and memcache 3.0.8 PECL extensions, and a number of additional utilities.

The php54 packages have been upgraded to upstream version 5.4.40, which provides a number of bug fixes over the version shipped in Red Hat Software Collections 1. (BZ#1168193)

The following security issues were fixed in the php54-php component:

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application.
(CVE-2015-0232)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened. (CVE-2015-2783, CVE-2015-3307, CVE-2015-3329)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash.
(CVE-2014-9705)

A heap buffer overflow flaw was found in PHP's regular expression extension. An attacker able to make PHP process a specially crafted regular expression pattern could cause it to crash and possibly execute arbitrary code. (CVE-2015-2305)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A use-after-free flaw was found in PHP's phar (PHP Archive) extension.
An attacker able to trigger certain error condition in phar archive processing could possibly use this flaw to disclose certain portions of server memory. (CVE-2015-2301)

An ouf-of-bounds read flaw was found in the way the File Information (fileinfo) extension processed certain Pascal strings. A remote attacker could cause a PHP application to crash if it used fileinfo to identify the type of the attacker-supplied file. (CVE-2014-9652)

It was found that PHP move_uploaded_file() function did not properly handle file names with a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348)

A flaw was found in the way PHP handled malformed source files when running in CGI mode. A specially crafted PHP file could cause PHP CGI to crash.
(CVE-2014-9427)

The following security issue was fixed in the php54-php-pecl-zendopcache component:

A use-after-free flaw was found in PHP's OPcache extension. This flaw could possibly lead to a disclosure of a portion of the server memory.
(CVE-2015-1351)

All php54 users are advised to upgrade to these updated packages, which correct these issues. After installing the updated packages, the httpd service must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL php54 package based on the guidance in RHSA-2015:1066.

Plugin Details

Severity: Critical

ID: 193682

File Name: redhat-RHSA-2015-1066.nasl

Version: 1.1

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 4/21/2024

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2015-4603

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:php54-runtime, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:php54-php-soap, p-cpe:/a:redhat:enterprise_linux:php54-php-bcmath, p-cpe:/a:redhat:enterprise_linux:php54-php-pdo, p-cpe:/a:redhat:enterprise_linux:php54, p-cpe:/a:redhat:enterprise_linux:php54-php-fpm, p-cpe:/a:redhat:enterprise_linux:php54-php-mbstring, p-cpe:/a:redhat:enterprise_linux:php54-php, p-cpe:/a:redhat:enterprise_linux:php54-php-cli, p-cpe:/a:redhat:enterprise_linux:php54-php-common, p-cpe:/a:redhat:enterprise_linux:php54-php-gd, p-cpe:/a:redhat:enterprise_linux:php54-php-odbc, p-cpe:/a:redhat:enterprise_linux:php54-php-dba, p-cpe:/a:redhat:enterprise_linux:php54-php-devel, p-cpe:/a:redhat:enterprise_linux:php54-php-pgsql, p-cpe:/a:redhat:enterprise_linux:php54-php-pspell, p-cpe:/a:redhat:enterprise_linux:php54-php-snmp, p-cpe:/a:redhat:enterprise_linux:php54-php-imap, p-cpe:/a:redhat:enterprise_linux:php54-php-mysqlnd, p-cpe:/a:redhat:enterprise_linux:php54-scldevel, p-cpe:/a:redhat:enterprise_linux:php54-php-pecl-zendopcache, p-cpe:/a:redhat:enterprise_linux:php54-php-recode, p-cpe:/a:redhat:enterprise_linux:php54-php-tidy, p-cpe:/a:redhat:enterprise_linux:php54-php-intl, p-cpe:/a:redhat:enterprise_linux:php54-php-enchant, p-cpe:/a:redhat:enterprise_linux:php54-php-ldap, cpe:/o:redhat:enterprise_linux:7, p-cpe:/a:redhat:enterprise_linux:php54-php-xml, p-cpe:/a:redhat:enterprise_linux:php54-php-xmlrpc, p-cpe:/a:redhat:enterprise_linux:php54-php-process

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 6/4/2015

Vulnerability Publication Date: 12/18/2014

Reference Information

CVE: CVE-2014-8142, CVE-2014-9427, CVE-2014-9652, CVE-2014-9705, CVE-2014-9709, CVE-2015-0231, CVE-2015-0232, CVE-2015-0273, CVE-2015-1351, CVE-2015-2301, CVE-2015-2305, CVE-2015-2348, CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-3411, CVE-2015-3412, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603, CVE-2015-4604, CVE-2015-4605, CVE-2015-8935

CWE: 113, 119, 121, 122, 125, 416, 626, 665, 822, 843

RHSA: 2015:1066

Detections

Analytics