Detections
Analytics
PHP 5.4.x < 5.4.34 / 5.5.x < 5.5.18 / 5.6.x < 5.6.2 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 8563
Synopsis
The remote web server uses an outdated version of PHP, leaving it vulnerable to several issues.Description
Versions earlier than 5.6.2, 5.5.18, and 5.4.34 are exposed to the following issues :- An array indexing flaw in the 'date_from_ISO8601()' function in ext/xmlrpc/libxmlrpc/xmlrpc.c could be used to disclose memory content (CVE-2014-3668)
- A memory corruption vulnerability when processing thumbnails in the 'exif_ifd_make_value()' function of ext/exif/exif.c could potentially crash the system or be a vector for remote code execution (CVE-2014-3670)
- An integer overflow condition in the 'object_custom()' function in ext/standard/var_unserializer.re can cause a crash (CVE-2014-3669)
- Memory content disclosure in ext/curl/interface.c when handling NULL bytes ('\0') in cURL options.
Solution
Apply the vendor's patch, or upgrade to the latest version. These issues have been fixed in versions 5.6.2, 5.5.18, and 5.4.34.See Also
Plugin Details
Severity: High
ID: 8563
Family: Web Servers
Published: 10/21/2014
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 6.6
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:php:php
Patch Publication Date: 10/16/2014
Vulnerability Publication Date: 10/16/2014