The extract function in PHP before 5.2.15 does not prevent use of the EXTR_OVERWRITE parameter to overwrite (1) the GLOBALS superglobal array and (2) the this variable, which allows context-dependent attackers to bypass intended access restrictions by modifying data structures that were not intended to depend on external input, a related issue to CVE-2005-2691 and CVE-2006-3758.

php5 was updated to fix several security issues. (CVE-2010-3709, CVE-2010-4150, CVE-2010-4645, CVE-2010-4697, CVE-2010-4698, CVE-2010-4699, CVE-2010-4700, CVE-2011-0752, CVE-2011-0753, CVE-2011-0755,CVE-2011-0708, CVE-2011-0420)

PHP5 was updated to fix several security issues. (CVE-2010-4150 / CVE-2010-4645 / CVE-2010-4697 / CVE-2010-4698 / CVE-2010-4699 / CVE-2011-0708 / CVE-2011-0752 / CVE-2011-0753 / CVE-2011-0755)

The remote host is affected by the vulnerability described in GLSA-201110-06 (PHP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PHP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code, obtain       sensitive information from process memory, bypass intended access       restrictions, or cause a Denial of Service in various ways.
    A remote attacker could cause a Denial of Service in various ways,       bypass spam detections, or bypass open_basedir restrictions.
  Workaround :

    There is no known workaround at this time.

php5 was updated to fix several security issues.

PHP5 was updated to fix several security issues.

According to its banner, the version of PHP 5.2 installed on the remote host is older than 5.2.15.  Such versions may be affected by several security issues :
  - A crash in the zip extract method.

  - A possible double free exists in the imap extension.
    (CVE-2010-4150)

  - An unspecified flaw exists in 'open_basedir'.     (CVE-2010-3436)

  - A possible crash could occur in 'mssql_fetch_batch()'.
  - A NULL pointer dereference exists in     'ZipArchive::getArchiveComment'. (CVE-2010-3709)

  - A crash exists if anti-aliasing steps are invalid.
    (Bug #53492)

  - A crash exists in pdo_firebird getAttribute(). (Bug     #53323)

  - A user-after-free vulnerability in the Zend engine when     a '__set()', '__get()', '__isset()' or '__unset()'     method is called can allow for a denial of service     attack. (Bug #52879 / CVE-2010-4697)

  - A stack-based buffer overflow exists in the     'imagepstext()' function in the GD extension. (Bug     #53492 / CVE-2010-4698)     
  - The extract function does not prevent use of the     EXTR_OVERWRITE parameter to overwrite the GLOBALS     superglobal array and the 'this' variable, which     allows attackers to bypass intended access restrictions.
    (CVE-2011-0752)

ID	Name	Product	Family	Type	Severity
75431	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:0276-1)	Nessus	SuSE Local Security Checks	Local	medium
57157	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7393)	Nessus	SuSE Local Security Checks	Local	medium
56459	GLSA-201110-06 : PHP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
53695	openSUSE Security Update : apache2-mod_php5 (openSUSE-SU-2011:0276-1)	Nessus	SuSE Local Security Checks	Local	medium
53285	SuSE 10 Security Update : PHP5 (ZYPP Patch Number 7375)	Nessus	SuSE Local Security Checks	Local	medium
53282	SuSE 11.1 Security Update : PHP5 (SAT Patch Number 4133)	Nessus	SuSE Local Security Checks	Local	medium
51139	PHP 5.2 < 5.2.15 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	medium

Detections

Analytics

CVE-2011-0752

high

Tenable Plugins

medium

medium

critical

medium

medium

medium

medium