Detections
Analytics

Mandriva Linux Security Advisory : php (MDVSA-2015:079)

high Nessus Plugin ID 82332

Language:

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

Multiple vulnerabilities has been discovered and corrected in php :

S. Paraschoudis discovered that PHP incorrectly handled memory in the enchant binding. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2014-9705).

Taoguang Chen discovered that PHP incorrectly handled unserializing objects. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-0273).

It was discovered that PHP incorrectly handled memory in the phar extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-2301).

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142 (CVE-2015-0231).

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way libzip, which is embedded in PHP, processed certain ZIP archives. If an attacker were able to supply a specially crafted ZIP archive to an application using libzip, it could cause the application to crash or, possibly, execute arbitrary code (CVE-2015-2331).

It was discovered that the PHP opcache component incorrectly handled memory. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1351).

It was discovered that the PHP PostgreSQL database extension incorrectly handled certain pointers. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-1352).

The updated php packages have been patched and upgraded to the 5.5.23 version which is not vulnerable to these issues. The libzip packages has been patched to address the CVE-2015-2331 flaw.

Additionally the php-xdebug package has been upgraded to the latest 2.3.2 and the PECL packages which requires so has been rebuilt for php-5.5.23.

Solution

Update the affected packages.

See Also

http://php.net/ChangeLog-5.php#5.5.22

http://php.net/ChangeLog-5.php#5.5.23

https://usn.ubuntu.com/2501-1/

https://usn.ubuntu.com/2535-1/

https://bugzilla.redhat.com/show_bug.cgi?id=1204676

Plugin Details

Severity: High

ID: 82332

File Name: mandriva_MDVSA-2015-079.nasl

Version: 1.15

Type: local

Published: 3/30/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.8

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:php-enchant, p-cpe:/a:mandriva:linux:php-exif, p-cpe:/a:mandriva:linux:php-fileinfo, p-cpe:/a:mandriva:linux:php-filter, p-cpe:/a:mandriva:linux:apache-mod_php, p-cpe:/a:mandriva:linux:lib64php5_common5, p-cpe:/a:mandriva:linux:lib64zip-devel, p-cpe:/a:mandriva:linux:lib64zip2, p-cpe:/a:mandriva:linux:libzip, p-cpe:/a:mandriva:linux:php-apc, p-cpe:/a:mandriva:linux:php-apc-admin, p-cpe:/a:mandriva:linux:php-bcmath, p-cpe:/a:mandriva:linux:php-bz2, p-cpe:/a:mandriva:linux:php-calendar, p-cpe:/a:mandriva:linux:php-cgi, p-cpe:/a:mandriva:linux:php-cli, p-cpe:/a:mandriva:linux:php-ctype, p-cpe:/a:mandriva:linux:php-curl, p-cpe:/a:mandriva:linux:php-dba, p-cpe:/a:mandriva:linux:php-devel, p-cpe:/a:mandriva:linux:php-doc, p-cpe:/a:mandriva:linux:php-dom, p-cpe:/a:mandriva:linux:php-mbstring, p-cpe:/a:mandriva:linux:php-mcrypt, p-cpe:/a:mandriva:linux:php-mssql, p-cpe:/a:mandriva:linux:php-mysql, p-cpe:/a:mandriva:linux:php-mysqli, p-cpe:/a:mandriva:linux:php-mysqlnd, p-cpe:/a:mandriva:linux:php-odbc, p-cpe:/a:mandriva:linux:php-opcache, p-cpe:/a:mandriva:linux:php-openssl, p-cpe:/a:mandriva:linux:php-pcntl, p-cpe:/a:mandriva:linux:php-pdo, p-cpe:/a:mandriva:linux:php-pdo_dblib, p-cpe:/a:mandriva:linux:php-pdo_mysql, p-cpe:/a:mandriva:linux:php-pdo_odbc, p-cpe:/a:mandriva:linux:php-pdo_pgsql, p-cpe:/a:mandriva:linux:php-pdo_sqlite, p-cpe:/a:mandriva:linux:php-pgsql, p-cpe:/a:mandriva:linux:php-phar, p-cpe:/a:mandriva:linux:php-posix, p-cpe:/a:mandriva:linux:php-readline, p-cpe:/a:mandriva:linux:php-recode, p-cpe:/a:mandriva:linux:php-session, p-cpe:/a:mandriva:linux:php-shmop, p-cpe:/a:mandriva:linux:php-snmp, p-cpe:/a:mandriva:linux:php-soap, p-cpe:/a:mandriva:linux:php-sockets, p-cpe:/a:mandriva:linux:php-sqlite3, p-cpe:/a:mandriva:linux:php-sybase_ct, p-cpe:/a:mandriva:linux:php-sysvmsg, p-cpe:/a:mandriva:linux:php-sysvsem, p-cpe:/a:mandriva:linux:php-sysvshm, p-cpe:/a:mandriva:linux:php-tidy, p-cpe:/a:mandriva:linux:php-tokenizer, p-cpe:/a:mandriva:linux:php-wddx, p-cpe:/a:mandriva:linux:php-xdebug, p-cpe:/a:mandriva:linux:php-xml, p-cpe:/a:mandriva:linux:php-xmlreader, p-cpe:/a:mandriva:linux:php-xmlrpc, p-cpe:/a:mandriva:linux:php-xmlwriter, p-cpe:/a:mandriva:linux:php-xsl, p-cpe:/a:mandriva:linux:php-zip, p-cpe:/a:mandriva:linux:php-zlib, cpe:/o:mandriva:business_server:1, p-cpe:/a:mandriva:linux:php-fpm, p-cpe:/a:mandriva:linux:php-ftp, p-cpe:/a:mandriva:linux:php-gd, p-cpe:/a:mandriva:linux:php-gettext, p-cpe:/a:mandriva:linux:php-gmp, p-cpe:/a:mandriva:linux:php-hash, p-cpe:/a:mandriva:linux:php-iconv, p-cpe:/a:mandriva:linux:php-imap, p-cpe:/a:mandriva:linux:php-ini, p-cpe:/a:mandriva:linux:php-intl, p-cpe:/a:mandriva:linux:php-json, p-cpe:/a:mandriva:linux:php-ldap

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/28/2015

Reference Information

CVE: CVE-2014-9705, CVE-2015-0231, CVE-2015-0273, CVE-2015-1351, CVE-2015-1352, CVE-2015-2301, CVE-2015-2331

BID: 71929, 71932, 72539, 72701, 73031, 73037, 73182

MDVSA: 2015:079