Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A response-splitting issue was discovered in the PHP session handling.
If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow.
(CVE-2006-4484)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues. These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption.

A vulnerability was discovered in the sscanf function that could allow attackers in certain circumstances to execute arbitrary code via argument swapping which incremented an index past the end of an array and triggered a buffer over-read.

Updated packages have been patched to correct these issues.

Updated PHP packages that fix a security issue are now available. 

This update has been rated as having important security impact by the Red Hat Security Response Team. 

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server. 

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues.  These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption. 


From Red Hat Security Advisory 2006:0730 :

The Hardened-PHP Project discovered an overflow in the PHP htmlentities() and htmlspecialchars() routines. If a PHP script used the vulnerable functions to parse UTF-8 data, a remote attacker sending a carefully crafted request could trigger the overflow and potentially execute arbitrary code as the 'apache' user.
(CVE-2006-5465)


From Red Hat Security Advisory 2006:0669 :

A response-splitting issue was discovered in the PHP session handling.
If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered in the PHP sscanf() function. If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user. (CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

A buffer overflow was discovered in the PHP gd extension. If a script was set up to process GIF images from untrusted sources using the gd extension, a remote attacker could cause a heap overflow.
(CVE-2006-4484)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

The remote host is affected by the vulnerability described in GLSA-200608-28 (PHP: Arbitary code execution)

    The sscanf() PHP function contains an array boundary error that can be     exploited to dereference a NULL pointer. This can possibly allow the     bypass of the safe mode protection by executing arbitrary code.
  Impact :

    A remote attacker might be able to exploit this vulnerability in PHP     applications making use of the sscanf() function, potentially resulting     in the execution of arbitrary code or the execution of scripted     contents in the context of the affected site.
  Workaround :

    There is no known workaround at this time.

- the CURL module lacked checks for control characters     (CVE-2006-2563))

  - str_repeat() contained an integer overflow

  - ext/wddx contained a buffer overflow

  - memory_limit() lacked checks for integer overflows

  - a bug in sscanf() could potentially be exploited to     execute arbitrary code (CVE-2006-4020)

  - an uninitialized varable caused apache to crash during     startup

  - corrupt gif images could crash php

The sscanf() function did not properly check array boundaries. In applications which use sscanf() with argument swapping, a remote attacker could potentially exploit this to crash the affected web application or even execute arbitrary code with the application's privileges. (CVE-2006-4020)

The file_exists() and imap_reopen() functions did not perform proper open_basedir and safe_mode checks which could allow local scripts to bypass intended restrictions. (CVE-2006-4481)

On 64 bit systems the str_repeat() and wordwrap() functions did not properly check buffer boundaries. Depending on the application, this could potentially be exploited to execute arbitrary code with the applications' privileges. This only affects the amd64 and sparc platforms. (CVE-2006-4482)

A buffer overflow was discovered in the LWZReadByte_() function of the GIF image file parser. By tricking a PHP application into processing a specially crafted GIF image, a remote attacker could exploit this to execute arbitrary code with the application's privileges.
(CVE-2006-4484).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- the CURL module lacked checks for control characters     (CVE-2006-2563))

  - str_repeat() contained an integer overflow

  - ext/wddx contained a buffer overflow

  - memory_limit() lacked checks for integer overflows

  - a bug in sscanf() could potentially be exploited to     execute arbitrary code. (CVE-2006-4020)

  - an uninitialized varable caused apache to crash during     startup

  - corrupt gif images could crash php

According to its banner, the version of PHP installed on the remote host is older than 4.4.4.  As such, it is potentially affected by the following vulnerabilities :

  - The c-client library 2000, 2001, or 2004 for PHP does     not check the safe_mode or open_basedir functions.
    (CVE-2006-1017)

  - A buffer overflow exists in the sscanf function.
    (CVE-2006-4020)

According to its banner, the version of PHP 5.x installed on the remote host is older than 5.1.5.  Such versions may be affected by the following vulnerabilities :

  - The c-client library 2000, 2001, or 2004 for PHP does     not check the safe_mode or open_basedir functions.
    (CVE-2006-1017)

  - A buffer overflow exists in the sscanf function.
    (CVE-2006-4020)

  - The file_exists and imap_reopen functions do not check     for the safe_mode and open_basedir settings, which     allows local users to bypass the settings.     (CVE-2006-4481)

  - Multiple heap-based buffer overflows exist in the     str_repeat and wordwrap functions in     ext/standard/string.c. (CVE-2006-4482)

  - The cURL extension files permit the     CURLOPT_FOLLOWLOCATION option when open_basedir or     safe_mode is enabled, which allows attackers to perform     unauthorized actions. (CVE-2006-4483)

  - A buffer overflow vulnerability exists in the     LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the     GD extension. (CVE-2006-4484)

  - The stripos function is affected by an out-of-bounds     read. (CVE-2006-4485)

Updated PHP packages that fix multiple security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Web server.

A response-splitting issue was discovered in the PHP session handling.
If a remote attacker can force a carefully crafted session identifier to be used, a cross-site-scripting or response-splitting attack could be possible. (CVE-2006-3016)

A buffer overflow was discovered found in the PHP sscanf() function.
If a script used the sscanf() function with positional arguments in the format string, a remote attacker sending a carefully crafted request could execute arbitrary code as the 'apache' user.
(CVE-2006-4020)

An integer overflow was discovered in the PHP wordwrap() and str_repeat() functions. If a script running on a 64-bit server used either of these functions on untrusted user data, a remote attacker sending a carefully crafted request might be able to cause a heap overflow. (CVE-2006-4482)

An integer overflow was discovered in the PHP memory allocation handling. On 64-bit platforms, the 'memory_limit' setting was not enforced correctly, which could allow a denial of service attack by a remote user. (CVE-2006-4486)

Users of PHP should upgrade to these updated packages which contain backported patches to correct these issues. These packages also contain a fix for a bug where certain input strings to the metaphone() function could cause memory corruption.

ID	Name	Product	Family	Published	Updated	Severity
22443	RHEL 3 / 4 : php (RHSA-2006:0669)	Nessus	Red Hat Local Security Checks	9/22/2006	1/14/2021	high
23893	Mandrake Linux Security Advisory : php (MDKSA-2006:144)	Nessus	Mandriva Local Security Checks	12/16/2006	1/6/2021	medium
67421	Oracle Linux 4 : php (ELSA-2006-0730 / ELSA-2006-0669)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
22290	GLSA-200608-28 : PHP: Arbitary code execution	Nessus	Gentoo Local Security Checks	8/30/2006	1/6/2021	medium
27146	openSUSE 10 Security Update : apache2-mod_php5 (apache2-mod_php5-2039)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	medium
27921	Ubuntu 5.04 / 5.10 / 6.06 LTS : php4, php5 vulnerabilities (USN-342-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	high
29374	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 2102)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	medium
17710	PHP < 4.4.4 Multiple Vulnerabilities	Nessus	CGI abuses	11/18/2011	11/22/2024	high
17713	PHP 5.1.x < 5.1.5 Multiple Vulnerabilities	Nessus	CGI abuses	11/18/2011	11/22/2024	critical
22423	CentOS 3 / 4 : php (CESA-2006:0669)	Nessus	CentOS Local Security Checks	9/22/2006	1/4/2021	high
22444	RHEL 2.1 : php (RHSA-2006:0682)	Nessus	Red Hat Local Security Checks	9/22/2006	1/14/2021	high

Detections

Analytics

Plugins Search

high

medium

high

medium

medium

high

medium

high

critical

high

high