According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.40. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the GetCode_()     function within file gd_gif_in.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2014-9709)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - A use-after-free error exists in the     phar_rename_archive() function within file     phar_object.c. An unauthenticated, remote attacker can     exploit this, by attempting to rename a phar archive to     an already existing file name, to cause a denial of     service condition. (CVE-2015-2301)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

PHP 5.4.x < 5.4.40 Multiple Vulnerabilities

critical Nessus Plugin ID 83033

Version 1.22

Version 1.21

Version 1.22 Nov 22, 2024, 4:32 PM Plugin metadata (remove script_exclude_keys for CGI scanning) Plugin Feed: 202411221632
Version 1.21 May 28, 2024, 5:14 PM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202405281714