The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2276-1 advisory.

    Francisco Alonso discovered that the PHP Fileinfo component incorrectly handled certain CDF documents. A     remote attacker could use this issue to cause PHP to hang or crash, resulting in a denial of service.
    (CVE-2014-0207, CVE-2014-3478, CVE-2014-3479, CVE-2014-3480, CVE-2014-3487)

    Stefan Esser discovered that PHP incorrectly handled unserializing SPL extension objects. An attacker     could use this issue to execute arbitrary code. (CVE-2014-3515)

    It was discovered that PHP incorrectly handled certain SPL Iterators. An attacker could use this issue to     cause PHP to crash, resulting in a denial of service. (CVE-2014-4670)

    It was discovered that PHP incorrectly handled certain ArrayIterators. An attacker could use this issue to     cause PHP to crash, resulting in a denial of service. (CVE-2014-4698)

    Stefan Esser discovered that PHP incorrectly handled variable types when calling phpinfo(). An attacker     could use this issue to possibly gain access to arbitrary memory, possibly containing sensitive     information. (CVE-2014-4721)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2276-1)

critical Nessus Plugin ID 76451

Version 1.19