According to its banner, the remote web server is running a version of PHP 5.5.x prior to 5.5.16. It is, therefore, affected by the following vulnerabilities :

  - LibGD contains a NULL pointer dereference flaw in its     'gdImageCreateFromXpm' function in the 'gdxpm.c' file.
    By using a specially crafted color mapping, a remote     attacker could cause a denial of service.
    (CVE-2014-2497)

  - The original upstream patch for CVE-2013-7345 did not     provide a complete solution. It is, therefore, still     possible for a remote attacker to deploy a specially     crafted input file to cause excessive resources to be     used when trying to detect the file type using awk     regular expression rules. This can cause a denial of     service. (CVE-2014-3538)

  - An integer overflow flaw exists in the 'cdf.c' file. By     using a specially crafted CDF file, a remote attacker     could cause a denial of service. (CVE-2014-3587)

  - There are multiple buffer overflow flaws in the 'dns.c'     file related to the 'dns_get_record' and 'dn_expand'     functions. By using a specially crafted DNS record,     a remote attacker could exploit these to cause a denial     of service or execute arbitrary code. (CVE-2014-3597)

  - There exist multiple flaws in the GD component within     the 'gd_ctx.c' file where user-supplied input is not     properly validated to ensure that pathnames lack %00     sequences. By using specially crafted input, a remote     attacker could overwrite arbitrary files.
    (CVE-2014-5120)

Note that Nessus has not attempted to exploit these issues, but has instead relied only on the application's self-reported version number.

Detections

Analytics

PHP 5.5.x < 5.5.16 Multiple Vulnerabilities

medium Nessus Plugin ID 77403

Version 1.12

Version 1.11

Version 1.12 Nov 22, 2024, 4:32 PM Plugin metadata (remove script_exclude_keys for CGI scanning) Plugin Feed: 202411221632
Version 1.11 May 31, 2024, 10:02 AM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202405311002