The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2572-1 advisory.

    It was discovered that PHP incorrectly handled cleanup when used with Apache 2.4. A remote attacker could     use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary     code. (CVE-2015-3330)

    It was discovered that PHP incorrectly handled opening tar, zip or phar archives through the PHAR     extension. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. (CVE-2015-3329)

    It was discovered that PHP incorrectly handled regular expressions. A remote attacker could use this issue     to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-2305)

    Paulos Yibelo discovered that PHP incorrectly handled moving files when a pathname contained a null     character. A remote attacker could use this issue to possibly bypass filename restrictions. This issue     only applied to Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2348)

    It was discovered that PHP incorrectly handled unserializing PHAR files. A remote attacker could use this     issue to cause PHP to possibly expose sensitive information. (CVE-2015-2783)

    Taoguang Chen discovered that PHP incorrectly handled unserializing certain objects. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-2787)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS : PHP vulnerabilities (USN-2572-1)

medium Nessus Plugin ID 82911

Version 1.16