根据其标题，远程 Web 服务器上运行的 PHP 5.4.x 版本低于 5.4.43。因此，它受到多种漏洞的影响：

- 存在名为“BACKRONYM”的安全功能绕过漏洞，原因是在使用 --ssl 客户端选项时，未能正确实施 SSL/TLS 的连接请求。中间人攻击者可利用此缺陷迫使客户端降级至未加密连接，允许攻击者泄露数据库数据或操纵数据库查询。(CVE-2015-3152)

- 由于在使用 --ssl 客户端选项时，未能正确实施 SSL/TLS 的连接请求，PHP Connector/C 组件中存在一个缺陷。
 中间人攻击者可利用此缺陷将连接降级为预期的普通 HTTP。(CVE-2015-8838) 
 - 在 phar_object.c 的 phar_convert_to_other() 函数中进行无效 TAR 文件转换时存在一个不明缺陷。攻击者可利用此缺陷造成 PHP 应用程序崩溃，从而导致拒绝服务。(OSVDB 124239)

- 在 parse_ini_file() 与 parse_ini_string() 函数中存在缺陷，原因是对包含换行符且换行符后为转义字符的字符串处理不当。攻击者可利用此缺陷造成 PHP 应用程序崩溃，从而导致拒绝服务。
 (OSVDB 124414)
 - 由于未正确验证用户提供的输入，在 object_custom() 中存在一个释放后使用错误。远程攻击者可利用此问题取消引用已经释放的内存，从而导致执行任意代码。(OSVDB 126953)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

根据其标题，远程 Web 服务器上运行的 PHP 5.6.x 版本低于 5.6.11。因此，它受到多种漏洞的影响：

- 存在名为“BACKRONYM”的安全功能绕过漏洞，原因是在使用 --ssl 客户端选项时，未能正确实施 SSL/TLS 的连接请求。中间人攻击者可利用此缺陷迫使客户端降级至未加密连接，允许攻击者泄露数据库数据或操纵数据库查询。(CVE-2015-3152)

- 由于在使用 --ssl 客户端选项时，未能正确实施 SSL/TLS 的连接请求，PHP Connector/C 组件中存在一个缺陷。
 中间人攻击者可利用此缺陷将连接降级为预期的普通 HTTP。(CVE-2015-8838) 
 - spl_recursive_it_move_forward_ex() 函数中存在释放后使用错误。攻击者可利用此错误取消引用已经释放的内存，从而可能允许执行任意代码。
 (OSVDB 124409)

- sqlite3SafetyCheckSickOrOk() 函数中存在释放后使用错误。攻击者可利用此错误取消引用已经释放的内存，从而可能允许执行任意代码。
 (OSVDB 124410)

- 启用延迟变量替换时，不会将“!”字符视为特殊字符。函数 escapeshellcmd() 和 escapeshellarg() 未能正确审查包含“!”的参数。
 攻击者可利用此缺陷执行任意命令。(OSVDB 124412)

- zend_vm_execute.h 中存在一个双重释放缺陷，原因是对特定代码处理不当。攻击者可利用此缺陷造成 PHP 应用程序崩溃，从而导致拒绝服务。(OSVDB 124413)

请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

根据其自我报告的版本号，远程 pfSense 的安装版本低于 2.2.4。因而，如参考供应商公告所述，它会受到多个漏洞的影响。

Versions of PHP 5.5.x earlier than 5.5.27, or 5.6.x earlier than 5.6.11 are vulnerable to the following issues :

 A double-free flaw exists in zend_vm_execute.h due to improper handling of certain code. An attacker can exploit this flaw to crash a PHP application, resulting in a denial of service condition.
 - A flaw exists in the parse_ini_file() and parse_ini_string() functions. Due to improper handling of strings that contain a line feed followed by an escape character, an attacker can exploit this to crash a PHP application, resulting in a denial of service condition.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.11. It is, therefore, affected by multiple vulnerabilities.
 - A security feature bypass vulnerability, known as 'BACKRONYM', exists due to a failure to properly enforce the requirement of an SSL/TLS connection when the --ssl client option is used. A man-in-the-middle attacker can exploit this flaw to coerce the client to downgrade to an unencrypted connection, allowing the attacker to disclose data from the database or manipulate database queries. (CVE-2015-3152)
 - A flaw in the phar_convert_to_other function in ext/phar/phar_object.c could allow a remote attacker to cause a denial of service. (CVE-2015-5589)
 - A Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c could allow a remote attacker to cause a denial of service. (CVE-2015-5590)
 - A flaw exists in the PHP Connector/C component due to a failure to properly enforce the requirement of an SSL/TLS connection when the --ssl client option is used.
 - A man-in-the-middle attacker can exploit this to downgrade the connection to plain HTTP when HTTPS is expected. (CVE-2015-8838)
 - A use-after-free error exists in the spl_recursive_it_move_forward_ex() function. An attacker can exploit this to dereference already freed memory, potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the sqlite3SafetyCheckSickOrOk() function. An attacker can exploit this to dereference already freed memory, potentially allowing the execution of arbitrary code.
 - The '!' character is not treated as a special character when delayed variable substitution is enabled. The functions escapeshellcmd() and escapeshellarg() are unable to properly sanitize arguments containing '!'.
 - An attacker can exploit this to execute arbitrary commands.
 - A double-free flaw exists in zend_vm_execute.h due to improper handling of certain code. An attacker can exploit this flaw to crash a PHP application, resulting in a denial of service condition.

Versions of PHP 5.5.x prior to 5.5.37, or 5.6.x prior to 5.6.23, or 7.0.x prior to 7.0.8 are vulnerable to the following issues :

 - PHP 'ext/mysqlnd/mysqlnd.c' contains a flaw that is due to the program failing to properly enforce the requirement of an SSL/TLS connection when the '--ssl client' option is used. This may allow a MitM (Man-in-the-Middle) attacker to downgrade the connection to plain HTTP when expected to be HTTPS. (CVE-2015-8838)
 - An integer overflow condition exists in the 'getFromIndex()'' and 'getFromName()' methods of 'ZipArchive'. The issue is triggered as user-supplied input is not properly validated when handling a specially crafted ZIP file. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-3078)
 - An XXE (Xml eXternal Entity) injection and expansion flaw affects the 'libxml_disable_entity_loader()' function in the source file 'ext/libxml/libxml.c' in PHP-FPM that is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can gain access to sensitive information or cause a denial of service. (CVE-2015-8866)
 - An integer overflow condition exists in the 'php_filter_encode_url()' function in 'ext/filter/sanitizing_filters.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4345)
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (CVE-2016-4346)
 - The program contains an out-of-bounds read flaw in 'ext/intl/grapheme/grapheme_string.c' that is triggered when handling negative offsets in 'zif_grapheme_stripos'. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4540, CVE-2016-4541)
 - An out-of-bounds read flaw exists in the 'php_str2num()' function in 'ext/bcmath/bcmath.c' that is triggered when accepting negative scales. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4537, CVE-2016-4538)
 - An out-of-bounds read flaw exists in the 'exif_read_data()' function in 'ext/exif/exif.c' that is triggered when handling exif headers. This may allow a remote attacker to crash a process utilizing the language or potentially disclose memory contents. (CVE-2016-4542, CVE-2016-4543, CVE-2016-4544)
 - A flaw in the 'xml_parse_into_struct()' function in 'ext/xml/xml.c' is triggered during the handling of a specially crafted XML content. This may allow a remote attacker to cause a denial of service. (CVE-2016-4539)
 - A double-free flaw exists in the 'php_formatted_print()' function in 'ext/standard/formatted_print.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-8880)
 - A flaw exists in 'main/php_open_temporary_file.c' that is triggered as thread safety is not ensured during the handling of temporary directories. This may allow a remote attacker to cause a denial of service. (CVE-2015-8878)
 - An integer overflow flaw exists in the 'php_html_entities()' and 'php_filter_full_special_chars()' functions in 'ext/standard/html.c' that is triggered as input is not properly validated. This may allow a remote attacker to have an unspecified impact. No further details have been provided. (CVE-2016-5094, CVE-2016-5095)
 - An integer underflow issue exists in 'ext/standard/file.c' that is triggered as input is not properly validated. This may allow a remote attacker to cause a NULL write and cause a process linked against PHP to crash. (CVE-2016-5096)
 - An out-of-bounds read flaw exists in the '_gdContributionsCalc()' function in 'ext/gd/libgd/gd_interpolation.c'. This may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2013-7456)
 - An out-of-bounds read flaw exists in the 'get_icu_value_internal()' function within 'ext/intl/locale/locale_methods.c' that is triggered when handling user-supplied input. This may allow a remote attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-5093)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the 'header()' function does not filter input passed via HTTP headers before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2015-8935)
 - A use-after-free error exists in the garbage collection algorithm in 'ext/zip/php_zip.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5773)
 - An integer overflow condition exists in the 'json_decode()' and 'json_utf8_to_utf16()' functions in 'ext/standard/php_smart_str.h'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, causing a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code.
 - An out-of-bounds read flaw exists within the 'pass2_no_dither()' function inside 'ext/gd/libgd/gd_topal.c' that may allow a remote attacker to crash a process utilizing PHP or potentially disclose memory contents.
 - An integer overflow condition exists in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string lengths. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw exists within the '_php_mb_regex_ereg_replace_exec()' function inside 'ext/mbstring/php_mbregex.c' that is triggered when handling a failed callback execution. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5768)
 - An integer overflow condition exists in 'ext/spl/spl_directory.c'. The issue is triggered by an 'int/size_t' confusion issue. This may allow a remote attacker to have an unspecified impact. (CVE-2016-5770)
 - An integer overflow condition exists in 'ext/mcrypt/mcrypt.c'. The issue is triggered as user-supplied input is not properly validated when handling data values. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5769)
 - An integer overflow condition exists within the 'nl2br()' function inside 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling new_length values. This may allow a remote attacker to have an unspecified impact.
 - An integer overflow condition exists within multiple functions in 'ext/standard/string.c'. The issue is triggered as user-supplied input is not properly validated when handling string values. This may allow a remote attacker to have an unspecified impact.
 - A double-free flaw within the 'php_wddx_process_data()' function inside 'ext/wddx/wddx.c' that is triggered during the handling of specially crafted XML content. This may allow a remote attacker to potentially execute arbitrary code. (CVE-2016-5772)
 - An integer overflow condition exists witin the 'gdImagePaletteToTrueColor()' function inside 'ext/gd/libgd/gd.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5767)
 - An invalid free flaw exists within the 'phar_extract_file()' function inside 'ext/phar/phar_object.c'. This may allow a remote attacker to have an unspecified impact. (CVE-2016-4473)
 - An integer overflow condition exists within the '_gd2GetHeader()' function inside 'ext/gd/libgd/gd_gd2.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service in a process linked against PHP or potentially allowing the execution of arbitrary code. (CVE-2016-5766)
 - A use-after-free error exists within the garbage collection algorithm inside 'ext/spl/spl_array.c'. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5771)

ID	Name	Product	Family	Published	Updated	Severity
84671	PHP 5.4.x < 5.4.43 多种漏洞 (BACKRONYM)	Nessus	CGI abuses	7/10/2015	5/31/2024	critical
84673	PHP 5.6.x < 5.6.11 多种漏洞 (BACKRONYM)	Nessus	CGI abuses	7/10/2015	5/31/2024	critical
106496	pfSense < 2.2.4 多个漏洞 (SA-15_07)	Nessus	Firewalls	1/31/2018	11/8/2019	medium
8955	PHP 5.5.x < 5.5.27 / 5.6.x < 5.6.11 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/7/2015	3/6/2019	high
8954	PHP 5.6.10 < 5.6.11 Multiple Vulnerabilities (BACKRONYM)	Nessus Network Monitor	Web Servers	10/7/2015	3/6/2019	high
9393	PHP 5.5.x < 5.5.37 / 5.6.x < 5.6.23 / 7.0.x < 7.0.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	7/13/2016	3/6/2019	high

Detections

Analytics

Plugins Search

critical

critical

medium

high

high

high