uPortal before 4.0.13.1 does not properly check the MANAGE permissions, which allows remote authenticated users to manage arbitrary portlets by leveraging the SUBSCRIBE permission for the portlet-admin portlet.

Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.6 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

Upstream reports that several bugs have been fixed as well as several security issues into some bundled libraries (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416 , CVE-2015-2325 and CVE-2015-2326). All PHP 5.5 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

Upstream reports that six security-related issues in PHP were fixed in this release, as well as several security issues in bundled sqlite library (CVE-2015-3414 , CVE-2015-3415 , CVE-2015-3416). All PHP 5.4 users are encouraged to upgrade to this version. Please see the upstream release notes for full details.

ID	Name	Product	Family	Severity
84625	Amazon Linux AMI : php56 (ALAS-2015-563)	Nessus	Amazon Linux Local Security Checks	critical
84624	Amazon Linux AMI : php55 (ALAS-2015-562)	Nessus	Amazon Linux Local Security Checks	critical
84623	Amazon Linux AMI : php54 (ALAS-2015-561)	Nessus	Amazon Linux Local Security Checks	critical

Detections

Analytics

CVE-2014-3416

medium

Tenable Plugins

critical

critical

critical