2015 年 9 月 3 日，**PHP 5.6.13** **核心：** * 修复了缺陷 #69900（管道上的超时过长）。(Anatol) * 已修复缺陷 #69487（SAPI 可能会截断 POST 数据）。(cmb) * 已修复缺陷 #70198（活性检查无法按预期进行）。(Shafreeck Sea, Anatol Belski) * 已修复缺陷 #70172 （unserialize()中存在释放后使用漏洞）。(Stas) * 已修复缺陷 #70219 （会话反序列化程序中存在释放后使用漏洞）。(taoguangchen at icloud dot com) **CLI 服务器：** * 修复了缺陷 #66606（设置 HTTP_CONTENT_TYPE 但不会设置 CONTENT_TYPE）。(wusuopu, cmb) * 已修复缺陷 #70264（CLI 服务器目录遍历）。(cmb) **日期：** * 修复了缺陷 #70266（DateInterval::__construct.interval_spec 不应该为可选）。(cmb)

- 修复了缺陷 #70277（新 DateTimeZone($foo) 忽略空字节后的文本）。(cmb) **EXIF：** * 修复了缺陷 #70385（包含 32 字节 TIFF IFD 标签字节值的 exif_read_data 中存在缓冲区读取越界）。(Stas) **哈希：** * 修复了缺陷 #70312（HAVAL 在特定情况下提供错误的哈希）。
 (letsgolee at naver dot com) **MCrypt：** * 修复了缺陷 #69833（mcrypt fd 缓存无法正常工作）。(Anatol) **Opcache：** * 修复了缺陷 #70237（启用 CLI 时，opcode 中存在空 while 和 do-while 分段错误）。
 （Dmitry、Laruence）**PCRE：** * 修复了缺陷 #70232（\K 的错误 bump-along 行为，以及空字符串匹配）。(cmb) * 已修复缺陷 #70345（与 PCRE 函数相关的多种漏洞）。(Anatol Belski) **SOAP：** * 修复了缺陷 #70388（SOAP serialize_function_call() 类型混淆 / RCE）。(Stas) **SPL：** * 修复了缺陷 #70290（spl_autoload 中通过 ob_start 进行的空指针取消引用（段错误））。(hugh at allthethings dot co dot nz) * 已修复缺陷 #70303 （ArrayObject 的错误构造函数反射）。
 (cmb) * 已修复缺陷 #70365（unserialize() 中 SplObjectStorage 的释放后使用漏洞）。(taoguangchen at icloud dot com) * 已修复缺陷 #70366 （unserialize() 中 SplDoublyLinkedList 的释放后使用漏洞）。(taoguangchen at icloud dot com) **标准：** * 修复了缺陷 #70052（当 WBMP 很大或很小时，getimagesize() 失败）。(cmb) * 已修复缺陷 #70157（INI_SCANNER_TYPED 的 parse_ini_string() 分段错误）。(Tjerk) **XSLT：** * 修复了缺陷 #69782（空指针取消引用）。(Stas)

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程主机正在运行的 Mac OS X 版本为 10.9.5 或更高，但低于 10.11.1，因此，它受到以下组件中多种漏洞的影响：

- 加速框架 (CVE-2015-5940)

- apache_mod_php（CVE-2015-0235、CVE-2015-0273、CVE-2015-6834、CVE-2015-6835、CVE-2015-6836、CVE-2015-6837、CVE-2015-6838）

- ATS (CVE-2015-6985)

- Audio（CVE-2015-5933、CVE-2015-5934、CVE-2015-7003）

- Bom (CVE-2015-7006)

- CFNetwork (CVE-2015-7023)

- configd (CVE-2015-7015)

- CoreGraphics（CVE-2015-5925、CVE-2015-5926）

- CoreText（CVE-2015-5944、CVE-2015-6975、CVE-2015-6992、CVE-2015-7017）

- Directory Utility (CVE-2015-6980)

- 磁盘映像 (CVE-2015-6995)

- EFI (CVE-2015-7035)

- File Bookmark (CVE-2015-6987)

- FontParser（CVE-2015-5927、CVE-2015-5942、CVE-2015-6976、CVE-2015-6977、CVE-2015-6978、CVE-2015-6990、CVE-2015-6991、CVE-2015-6993、CVE-2015-7008、CVE-2015-7009、CVE-2015-7010、CVE-2015-7018）

- Grand Central Dispatch (CVE-2015-6989)

- Graphics Drivers（CVE-2015-7019、CVE-2015-7020、CVE-2015-7021）

- ImageIO（CVE-2015-5935、CVE-2015-5936、CVE-2015-5937、CVE-2015-5938、CVE-2015-5939）

- IOAcceleratorFamily (CVE-2015-6996)

- IOHIDFamily (CVE-2015-6974)

- 内核（CVE-2015-5932、CVE-2015-6988、CVE-2015-6994）

- libarchive (CVE-2015-6984)

- MCX 应用程序限制 (CVE-2015-7016)

- Net-SNMP（CVE-2014-3565、CVE-2012-6151）

- OpenGL (CVE-2015-5924)

- OpenSSH (CVE-2015-6563)

- Sandbox (CVE-2015-5945)

- Script Editor (CVE-2015-7007)

- Security（CVE-2015-6983、CVE-2015-7024）

- SecurityAgent (CVE-2015-5943)

请注意，如果成功利用最严重的问题则可能导致执行任意代码。

The remote host is running a version of Mac OS X version 10.11.x prior to 10.11.1 and is affected by multiple vulnerabilities in the following components :

 - Accelerate Framework (CVE-2015-5940)
 - apache_mod_php (CVE-2015-0235, CVE-2015-0273, CVE-2015-6834, CVE-2015-6835, CVE-2015-6836, CVE-2015-6837, CVE-2015-6838)
 - ATS (CVE-2015-6985)
 - Audio (CVE-2015-5933, CVE-2015-5934, CVE-2015-7003)
 - Bom (CVE-2015-7006)
 - CFNetwork (CVE-2015-7023)
 - configd (CVE-2015-7015)
 - CoreGraphics (CVE-2015-5925, CVE-2015-5926)
 - CoreText (CVE-2015-5944, CVE-2015-6975, CVE-2015-6992, CVE-2015-7017)
 - Directory Utility (CVE-2015-6980)
 - Disk Images (CVE-2015-6995)
 - EFI (CVE-2015-7035)
 - File Bookmark (CVE-2015-6987)
 - FontParser (CVE-2015-5927, CVE-2015-5942, CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, CVE-2015-7018)
 - Grand Central Dispatch (CVE-2015-6989)
 - Graphics Drivers (CVE-2015-7019, CVE-2015-7020, CVE-2015-7021)
 - ImageIO (CVE-2015-5935, CVE-2015-5936, CVE-2015-5937, CVE-2015-5938, CVE-2015-5939)
 - IOAcceleratorFamily (CVE-2015-6996)
 - IOHIDFamily (CVE-2015-6974)
 - Kernel (CVE-2015-5932, CVE-2015-6988, CVE-2015-6994)
 - libarchive (CVE-2015-6984)
 - MCX Application Restrictions (CVE-2015-7016)
 - Net-SNMP (CVE-2014-3565, CVE-2012-6151)
 - OpenGL (CVE-2015-5924)
 - OpenSSH (CVE-2015-6563)
 - Sandbox (CVE-2015-5945)
 - Script Editor (CVE-2015-7007)
 - Security (CVE-2015-6983, CVE-2015-7024)
 - SecurityAgent (CVE-2015-5943)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Versions of PHP 5.4.x prior to 5.4.45, 5.5.x prior to 5.5.29, or 5.6.x prior to 5.6.13 are vulnerable to the following issues :

  - A use-after-free error exists in the unserialize() function in 'ext/spl/spl_observer.c'. The issue is triggered as user-supplied input is not sanitized. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A type confusion flaw affects the serialize_function_call() function in 'ext/soap/soap.c'. The issue is triggered when handling input passed via the header field. This may allow a remote attacker to execute arbitrary code.
 - A use-after-free error affects the object_custom() function in 'ext/standard/var_unserializer.c'. The issue is triggered when handling user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A use-after-free error affects the unserialize() function in 'ext/spl/spl_dllist.c'. The issue is triggered during the deserialization of user-supplied input. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - An out-of-bounds read flaw in the exif_process_IFD_TAG() function in 'ext/exif/exif.c' that is triggered when handling TIFF IFD tags. This may allow a context-dependent attacker to crash an application linked against PHP or potentially disclose memory contents.
 - An overflow condition exists in the php_pcre_match_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the php_pcre_split_impl() function in 'ext/pcre/php_pcre.c'. The flaw is triggered during the handling of offsets that consist of a start and end position within the subject string, which can cause an exhaustion of memory resources. This may allow a remote attacker to exhaust available memory.
 - An overflow condition affects the php_pcre_replace_impl() function in 'ext/pcre/php_pcre.c'. The issue is triggered as user-supplied input is not properly validated when handling offsets. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A use-after-free error exists in the php_var_unserialize() function of the session deserializer (php_binary/php_serialize). The issue is triggered when deserializing multiple forms of data. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code.
 - A NULL pointer dereference flaw exists in the xsl_ext_function_php() function in 'ext/xsl/xsltprocessor.c' that is triggered as checks are not properly performed on user-supplied input. This may allow a remote attacker to cause a denial of service.
 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the php_zip_extract_file() function in 'ext/zip/php_zip.c' not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') passed to the ZipArchive::extractTo() method. This may allow a remote attacker to create arbitrary directories.

ID	Name	Product	Family	Published	Updated	Severity
85933	Fedora 21：php-5.6.13-1.fc21 (2015-14976)	Nessus	Fedora Local Security Checks	9/15/2015	1/11/2021	critical
86654	Mac OS X < 10.11.1 多种漏洞	Nessus	MacOS X Local Security Checks	10/29/2015	5/28/2024	info
9324	Mac OS X 10.9.5 or later < 10.11.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	5/27/2016	3/6/2019	critical
8861	PHP 5.4.x < 5.4.45 / 5.5.x < 5.5.29 / 5.6.x < 5.6.13 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	9/14/2015	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

info

critical

critical