Detections
Analytics
PHP 5.4.x < 5.4.18 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 6996
Synopsis
The remote web server uses a version of PHP that is affected by multiple vulnerabilities.Description
PHP versions 5.4.x earlier than 5.4.18 are affected by the following vulnerabilities : - A heap corruption error exists in numerous functions in the file 'ext/xml/xml.c'. (CVE-2013-4113 / Bug #65236)- An error exists related to certificate validation, the 'subjectAltName' field and certificates containing NULL bytes. This error can allow spoofing attacks. (CVE-2013-4248)
Solution
Apply the vendor patch or upgrade to PHP version 5.4.18 or later.See Also
Plugin Details
Severity: High
ID: 6996
Family: Web Servers
Published: 8/21/2013
Updated: 3/6/2019
Nessus ID: 69401
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9.3
Temporal Score: 7.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.5
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:php:php
Patch Publication Date: 8/15/2013
Vulnerability Publication Date: 7/10/2013
Reference Information
CVE: CVE-2013-4113, CVE-2013-4248