The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-184:01 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated webpages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    The php package contains the module which adds support for the PHP     language to Apache HTTP Server.
    Security issues fixed with this release:
    CVE-2014-9425     CVE-2014-9705     CVE-2014-9709     CVE-2015-0232     CVE-2015-0273     CVE-2015-2301     CVE-2015-2783     CVE-2015-2787     CVE-2015-3307     CVE-2015-3329     CVE-2015-3411     CVE-2015-3412     CVE-2015-4021     CVE-2015-4022     CVE-2015-4024     CVE-2015-4026     CVE-2015-4147     CVE-2015-4148     CVE-2015-4598     CVE-2015-4599     CVE-2015-4600     CVE-2015-4601     CVE-2015-4602     CVE-2015-4603

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-130:01 advisory.

    PHP is an HTML-embedded scripting language. PHP attempts to make it     easy for developers to write dynamically generated web pages. PHP also     offers built-in database integration for several commercial and     non-commercial database management systems, so writing a     database-enabled webpage with PHP is fairly simple. The most common     use of PHP coding is probably as a replacement for CGI scripts.
    This package contains the module (often referred to as mod_php)     which adds support for the PHP language to Apache HTTP 2.4 Server.
    Security issues fixed with this release:
    CVE-2015-2783     ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to obtain sensitive information     from process memory or cause a denial of service (buffer over-read and     application crash) via a crafted length value in conjunction with     crafted serialized data in a phar archive, related to the     phar_parse_metadata and phar_parse_pharfile functions.
    CVE-2015-3307     The phar_parse_metadata function in ext/phar/phar.c in PHP before     5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote     attackers to cause a denial of service (heap metadata corruption) or     possibly have unspecified other impact via a crafted tar archive.
    CVE-2015-3329     Multiple stack-based buffer overflows in the phar_set_inode function     in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and     5.6.x before 5.6.8 allow remote attackers to execute arbitrary code     via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.
    CVE-2015-3330     The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP     before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the     Apache HTTP Server 2.4.x is used, allows remote attackers to cause a     denial of service (application crash) or possibly execute arbitrary     code via pipelined HTTP requests that result in a deconfigured     interpreter.
    CVE-2015-3411
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-3412
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4021     The phar_parse_tarfile function in ext/phar/tar.c in PHP before     5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify     that the first character of a filename is different from the \0     character, which allows remote attackers to cause a denial of service     (integer underflow and memory corruption) via a crafted entry in a tar     archive.
    CVE-2015-4022     Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP     before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows     remote FTP servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.
    CVE-2015-4024     Algorithmic complexity vulnerability in the multipart_buffer_headers     function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25,     and 5.6.x before 5.6.9 allows remote attackers to cause a denial of     service (CPU consumption) via crafted form data that triggers an     improper order-of-growth outcome.
    CVE-2015-4025     PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9     truncates a pathname upon encountering a \x00 character in certain     situations, which allows remote attackers to bypass intended extension     restrictions and access files or directories with unexpected names via     a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or     (4) readlink.  NOTE: this vulnerability exists because of an incomplete     fix for CVE-2006-7243.
    CVE-2015-4026     The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before     5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering     a \x00 character, which might allow remote attackers to bypass     intended extension restrictions and execute files with unexpected     names via a crafted first argument.  NOTE: this vulnerability exists     because of an incomplete fix for CVE-2006-7243.
    CVE-2015-4598
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4602
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4603
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4604
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4605
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4643
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-4644
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x     before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly     have unspecified other impact via a crafted tar archive. (CVE-2015-3307)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1066 advisory.

    PHP is an HTML-embedded scripting language commonly used with the Apache     HTTP Server. The php54 packages provide a recent stable release of PHP with     the PEAR 1.9.4, APC 3.1.15, and memcache 3.0.8 PECL extensions, and a     number of additional utilities.

    The php54 packages have been upgraded to upstream version 5.4.40, which     provides a number of bug fixes over the version shipped in Red Hat Software     Collections 1. (BZ#1168193)

    The following security issues were fixed in the php54-php component:

    A flaw was found in the way the PHP module for the Apache httpd web server     handled pipelined requests. A remote attacker could use this flaw to     trigger the execution of a PHP script in a deinitialized interpreter,     causing it to crash or, possibly, execute arbitrary code. (CVE-2015-3330)

    An uninitialized pointer use flaw was found in PHP's Exif extension. A     specially crafted JPEG or TIFF file could cause a PHP application using the     exif_read_data() function to crash or, possibly, execute arbitrary code     with the privileges of the user running that PHP application.
    (CVE-2015-0232)

    Multiple flaws were discovered in the way PHP performed object     unserialization. Specially crafted input processed by the unserialize()     function could cause a PHP application to crash or, possibly, execute     arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273,     CVE-2015-2787, CVE-2015-4147, CVE-2015-4148)

    Multiple flaws were found in the way the way PHP's Phar extension parsed     Phar archives. A specially crafted archive could cause PHP to crash or,     possibly, execute arbitrary code when opened. (CVE-2015-2783,     CVE-2015-3307, CVE-2015-3329)

    A heap buffer overflow flaw was found in the enchant_broker_request_dict()     function of PHP's enchant extension. An attacker able to make a PHP     application enchant dictionaries could possibly cause it to crash.
    (CVE-2014-9705)

    A heap buffer overflow flaw was found in PHP's regular expression     extension. An attacker able to make PHP process a specially crafted regular     expression pattern could cause it to crash and possibly execute arbitrary     code. (CVE-2015-2305)

    A buffer over-read flaw was found in the GD library used by the PHP gd     extension. A specially crafted GIF file could cause a PHP application using     the imagecreatefromgif() function to crash. (CVE-2014-9709)

    A use-after-free flaw was found in PHP's phar (PHP Archive) extension.
    An attacker able to trigger certain error condition in phar archive     processing could possibly use this flaw to disclose certain portions of     server memory. (CVE-2015-2301)

    An ouf-of-bounds read flaw was found in the way the File Information     (fileinfo) extension processed certain Pascal strings. A remote attacker     could cause a PHP application to crash if it used fileinfo to identify the     type of the attacker-supplied file. (CVE-2014-9652)

    It was found that PHP move_uploaded_file() function did not properly handle     file names with a NULL character. A remote attacker could possibly use this     flaw to make a PHP script access unexpected files and bypass intended file     system access restrictions. (CVE-2015-2348)

    A flaw was found in the way PHP handled malformed source files when running     in CGI mode. A specially crafted PHP file could cause PHP CGI to crash.
    (CVE-2014-9427)

    The following security issue was fixed in the php54-php-pecl-zendopcache     component:

    A use-after-free flaw was found in PHP's OPcache extension. This flaw could     possibly lead to a disclosure of a portion of the server memory.
    (CVE-2015-1351)

    All php54 users are advised to upgrade to these updated packages, which     correct these issues. After installing the updated packages, the httpd     service must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1186 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - pgsql: fix NULL pointer dereference CVE-2015-1352

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1066 advisory.

    - fix use after free CVE-2015-1351

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaws was discovered in the way PHP performed object     unserialization. Specially crafted input processed by     the unserialize() function could cause a PHP     application to crash or, possibly, execute arbitrary     code.(CVE-2015-4147)

  - An invalid free flaw was found in the way PHP's Phar     extension parsed Phar archives. A specially crafted     archive could cause PHP to crash or, possibly, execute     arbitrary code when opened.(CVE-2015-3307)

  - A flaw was found in the way the PHP module for the     Apache httpd web server handled pipelined requests. A     remote attacker could use this flaw to trigger the     execution of a PHP script in a deinitialized     interpreter, causing it to crash or, possibly, execute     arbitrary code.(CVE-2015-3330)

  - Multiple flaws were discovered in the way PHP's Soap     extension performed object unserialization. Specially     crafted input processed by the unserialize() function     could cause a PHP application to disclose portion of     its memory or crash.(CVE-2015-4600)

  - Zend/zend_exceptions.c in PHP, possibly 5.x before     5.6.28 and 7.x before 7.0.13, allows remote attackers     to cause a denial of service (infinite loop) via a     crafted Exception object in serialized data, a related     issue to CVE-2015-8876.(CVE-2016-7478)

  - It was found that certain PHP functions did not     properly handle file names containing a NULL character.
    A remote attacker could possibly use this flaw to make     a PHP script access unexpected files and bypass     intended file system access     restrictions.(CVE-2015-3411)

  - The asn1_time_to_time_t function in     ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x     before 5.4.23, and 5.5.x before 5.5.7 does not properly     parse (1) notBefore and (2) notAfter timestamps in     X.509 certificates, which allows remote attackers to     execute arbitrary code or cause a denial of service     (memory corruption) via a crafted certificate that is     not properly handled by the openssl_x509_parse     function.(CVE-2013-6420)

  - A use-after-free flaw was found in PHP's phar (PHP     Archive) paths implementation. A malicious script     author could possibly use this flaw to disclose certain     portions of server memory.(CVE-2015-2301)

  - In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before     7.1.25, and 7.2.x before 7.2.13, a buffer over-read in     PHAR reading functions may allow an attacker to read     allocated or unallocated memory past the actual data     when trying to parse a .phar file. This is related to     phar_parse_pharfile in ext/phar/phar.c.(CVE-2018-20783)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. Invalid input to the function xmlrpc_decode()     can lead to an invalid memory access (heap out of     bounds read or read after free). This is related to     xml_elem_parse_buf in     ext/xmlrpc/libxmlrpc/xml_element.c.(CVE-2019-9020)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9021)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9023)

  - An issue was discovered in PHP before 5.6.40, 7.x     before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before     7.3.1. A heap-based buffer over-read in PHAR reading     functions in the PHAR extension may allow an attacker     to read allocated or unallocated memory past the actual     data when trying to parse the file name, a different     vulnerability than CVE-2018-20783. This is related to     phar_detect_phar_fname_ext in     ext/phar/phar.c.(CVE-2019-9024)

  - An issue was discovered in PHP before 7.1.27, 7.2.x     before 7.2.16, and 7.3.x before 7.3.3. Due to the way     rename() across filesystems is implemented, it is     possible that file being renamed is briefly available     with wrong permissions while the rename is ongoing,     thus enabling unauthorized users to access the     data.(CVE-2019-9637)

  - An issue was discovered in the EXIF component in PHP     before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before     7.3.3. There is an Invalid Read in     exif_process_SOFn.(CVE-2019-9640)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

- An unspecified use-after-free error exists in the _zend_shared_memdup() function within file ext/opcache/zend_shared_alloc.c that allows an unauthenticated, remote attacker to have an unspecified impact. (CVE-2015-1351)

- A NULL pointer dereference flaw exists in the build_tablename() function within file pgsql.c in the PostgreSQL extension due to a failure to validate token extraction for table names. An authenticated, remote attacker can exploit this, via a crafted name, to cause a denial of service condition. (CVE-2015-1352)

- An out-of-bounds read error exists in the Phar component due to improper validation of user-supplied input when handling phar parsing during unserialize() function calls. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the disclosure of memory contents. (CVE-2015-2783)

- A memory corruption issue exists in the phar_parse_metadata() function in file ext/phar/phar.c due to improper validation of user-supplied input when parsing a specially crafted TAR archive. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3307)

- Multiple stack-based buffer overflow conditions exist in the phar_set_inode() function in file phar_internal.h when handling archive files, such as tar, zip, or phar files. An unauthenticated, remote attacker can exploit these to cause a denial of service condition or the execution or arbitrary code. (CVE-2015-3329)

- A flaw exists in the Apache2handler SAPI component when handling pipelined HTTP requests that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-3330)

- A flaw exists in multiple functions due to a failure to check for NULL byte (%00) sequences in a path when processing or reading a file. An unauthenticated, remote attacker can exploit this, via specially crafted input to an application calling those functions, to bypass intended restrictions and disclose potentially sensitive information. (CVE-2015-3411, CVE-2015-3412)

- A type confusion error exists in multiple functions within file ext/soap/soap.c that is triggered when calling unserialize(). An unauthenticated, remote attacker can exploit this to disclose memory contents, cause a denial of service condition, or execute arbitrary code. (CVE-2015-4599, CVE-2015-4600)

- Multiple type confusion errors exist within files ext/soap/php_encoding.c, ext/soap/php_http.c, and ext/soap/soap.c that allow an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4601)

- A type confusion error exists in the __PHP_Incomplete_Class() function within file ext/standard/incomplete_class.c that allows an unauthenticated, remote attacker to cause a denial of service condition or the execution of arbitrary code. (CVE-2015-4602)

- A type confusion error exists in the exception::getTraceAsString() function within file Zend/zend_exceptions.c that allows a remote attacker to execute arbitrary code. (CVE-2015-4603)

- A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mget() function within file softmagic.c. The function fails to maintain a certain pointer relationship. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4604)

- A denial of service vulnerability exists due to a flaw in the bundled libmagic library, specifically in the mcopy() function within file softmagic.c. The function fails to properly handle an offset that exceeds 'bytecnt'. An unauthenticated, remote attacker can exploit this, via a crafted string, to crash the application. (CVE-2015-4605)

- A use-after-free error exists in the sqlite3_close() function within file /ext/sqlite3/sqlite3.c when closing database connections. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

- A flaw exists in the ZEND_VM_HELPER_EX() function within file /Zend/zend_vm_def.h when handling a __get() function call. An unauthenticated, remote attacker can exploit this to cause a cause a denial of service condition.

- A type confusion error exists in the php_stream_url_wrap_http_ex() function within file ext/standard/http_fopen_wrapper.c that allows an unauthenticated, remote attacker to execute arbitrary code.

- A use-after-free error exists in the php_curl() function within file ext/curl/interface.c that allows an unauthenticated, remote attacker to execute arbitrary code.

- A use-after-free error exists in the SPL component, specifically in the spl_object_storage_get_gc() function within file ext/spl/spl_observer.c. An unauthenticated, remote attacker can exploit this to execute arbitrary code.

- A NULL pointer dereference flaw exists within file /ext/ereg/regex/regcomp.c that allows an unauthenticated, remote attacker attacker to cause a denial of service condition.

Note that the scanner has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

- CVE-2015-3307 The phar_parse_metadata function in     ext/phar/phar.c in PHP before 5.4.40, 5.5.x before     5.5.24, and 5.6.x before 5.6.8 allows remote attackers     to cause a denial of service (heap metadata corruption)     or possibly have unspecified other impact via a crafted     tar archive.

  - CVE-2015-3411 + CVE-2015-3412 Fixed bug #69353 (Missing     null byte checks for paths in various PHP extensions)

  - CVE-2015-4021 The phar_parse_tarfile function in     ext/phar/tar.c in PHP before 5.4.41, 5.5.x before     5.5.25, and 5.6.x before 5.6.9 does not verify that the     first character of a filename is different from the \0     character, which allows remote attackers to cause a     denial of service (integer underflow and memory     corruption) via a crafted entry in a tar archive.

  - CVE-2015-4022 Integer overflow in the ftp_genlist     function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x     before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP     servers to execute arbitrary code via a long reply to a     LIST command, leading to a heap-based buffer overflow.

  - CVE-2015-4025 PHP before 5.4.41, 5.5.x before 5.5.25,     and 5.6.x before 5.6.9 truncates a pathname upon     encountering a \x00 character in certain situations,     which allows remote attackers to bypass intended     extension restrictions and access files or directories     with unexpected names via a crafted argument to (1)     set_include_path, (2) tempnam, (3) rmdir, or (4)     readlink. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2006-7243.

  - CVE-2015-4026 The pcntl_exec implementation in PHP     before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before     5.6.9 truncates a pathname upon encountering a \x00     character, which might allow remote attackers to bypass     intended extension restrictions and execute files with     unexpected names via a crafted first argument. NOTE:
    this vulnerability exists because of an incomplete fix     for CVE-2006-7243.

  - CVE-2015-4147 The SoapClient::__call method in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that
    __default_headers is an array, which allows remote     attackers to execute arbitrary code by providing crafted     serialized data with an unexpected data type, related to     a 'type confusion' issue.

  - CVE-2015-4148 The do_soap_call function in     ext/soap/soap.c in PHP before 5.4.39, 5.5.x before     5.5.23, and 5.6.x before 5.6.7 does not verify that the     uri property is a string, which allows remote attackers     to obtain sensitive information by providing crafted     serialized data with an int data type, related to a     'type confusion' issue.

  - CVE-2015-4598 Incorrect handling of paths with NULs

  - CVE-2015-4599 Type confusion vulnerability in     exception::getTraceAsString

  - CVE-2015-4600 + CVE-2015-4601 Added type checks

  - CVE-2015-4602 Type Confusion Infoleak Vulnerability in     unserialize() with SoapFault

  - CVE-2015-4604 + CVE-2015-4605 denial of service when     processing a crafted file with Fileinfo (already fixed     in CVE-2015-temp-68819.patch)

  - CVE-2015-4643 Improved fix for bug #69545 (Integer     overflow in ftp_genlist() resulting in heap overflow)

  - CVE-2015-4644 Fixed bug #69667 (segfault in     php_pgsql_meta_data)

  - CVE-2015-5589 Segfault in Phar::convertToData on invalid     file

  - CVE-2015-5590 Buffer overflow and stack smashing error     in phar_fix_filepath

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.8.5 or 10.9.5 that is missing Security Update 2015-006. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - CoreText
  - FontParser
  - Libinfo
  - libxml2
  - OpenSSL
  - perl
  - PostgreSQL
  - QL Office
  - Quartz Composer Framework
  - QuickTime 7
  - SceneKit

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

A double free flaw was found in zend_ts_hash_graceful_destroy() function in the PHP ZTS module. This flaw could possibly cause a PHP application to crash. (CVE-2014-9425)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1218 advisory.

    - fix patch for CVE-2015-4024
    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
    - core: fix use-after-free in unserialize CVE-2015-2787
    - exif: fix free on unitialized pointer CVE-2015-0232
    - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
    - date: fix use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - phar: use after free in phar_object.c CVE-2015-2301

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

  - The libgmp library in some cases terminated unexpectedly     with a segmentation fault when being used with other     libraries that use the GMP memory management. With this     update, PHP no longer changes libgmp memory allocators,     which prevents the described crash from occurring.

  - When using the Open Database Connectivity (ODBC) API,     the PHP process in some cases terminated unexpectedly     with a segmentation fault. The underlying code has been     adjusted to prevent this crash.

  - Previously, running PHP on a big-endian system sometimes     led to memory corruption in the fileinfo module. This     update adjusts the behavior of the PHP pointer so that     it can be freed without causing memory corruption.

After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

Updated php packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

A flaw was found in the way the PHP module for the Apache httpd web server handled pipelined requests. A remote attacker could use this flaw to trigger the execution of a PHP script in a deinitialized interpreter, causing it to crash or, possibly, execute arbitrary code.
(CVE-2015-3330)

A flaw was found in the way PHP parsed multipart HTTP POST requests. A specially crafted request could cause PHP to use an excessive amount of CPU time. (CVE-2015-4024)

An uninitialized pointer use flaw was found in PHP's Exif extension. A specially crafted JPEG or TIFF file could cause a PHP application using the exif_read_data() function to crash or, possibly, execute arbitrary code with the privileges of the user running that PHP application. (CVE-2015-0232)

An integer overflow flaw leading to a heap-based buffer overflow was found in the way PHP's FTP extension parsed file listing FTP server responses. A malicious FTP server could use this flaw to cause a PHP application to crash or, possibly, execute arbitrary code.
(CVE-2015-4022)

Multiple flaws were discovered in the way PHP performed object unserialization. Specially crafted input processed by the unserialize() function could cause a PHP application to crash or, possibly, execute arbitrary code. (CVE-2014-8142, CVE-2015-0231, CVE-2015-0273, CVE-2015-2787, CVE-2015-4147, CVE-2015-4148, CVE-2015-4599, CVE-2015-4600, CVE-2015-4601, CVE-2015-4602, CVE-2015-4603)

It was found that certain PHP functions did not properly handle file names containing a NULL character. A remote attacker could possibly use this flaw to make a PHP script access unexpected files and bypass intended file system access restrictions. (CVE-2015-2348, CVE-2015-4025, CVE-2015-4026, CVE-2015-3411, CVE-2015-3412, CVE-2015-4598)

Multiple flaws were found in the way the way PHP's Phar extension parsed Phar archives. A specially crafted archive could cause PHP to crash or, possibly, execute arbitrary code when opened.
(CVE-2015-2301, CVE-2015-2783, CVE-2015-3307, CVE-2015-3329, CVE-2015-4021)

Multiple flaws were found in PHP's File Information (fileinfo) extension. A remote attacker could cause a PHP application to crash if it used fileinfo to identify type of attacker supplied files.
(CVE-2014-9652, CVE-2015-4604, CVE-2015-4605)

A heap buffer overflow flaw was found in the enchant_broker_request_dict() function of PHP's enchant extension. An attacker able to make a PHP application enchant dictionaries could possibly cause it to crash. (CVE-2014-9705)

A buffer over-read flaw was found in the GD library used by the PHP gd extension. A specially crafted GIF file could cause a PHP application using the imagecreatefromgif() function to crash. (CVE-2014-9709)

This update also fixes the following bugs :

* The libgmp library in some cases terminated unexpectedly with a segmentation fault when being used with other libraries that use the GMP memory management. With this update, PHP no longer changes libgmp memory allocators, which prevents the described crash from occurring.
(BZ#1212305)

* When using the Open Database Connectivity (ODBC) API, the PHP process in some cases terminated unexpectedly with a segmentation fault. The underlying code has been adjusted to prevent this crash.
(BZ#1212299)

* Previously, running PHP on a big-endian system sometimes led to memory corruption in the fileinfo module. This update adjusts the behavior of the PHP pointer so that it can be freed without causing memory corruption. (BZ#1212298)

All php users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1135 advisory.

    - core: fix multipart/form-data request can use excessive       amount of CPU usage CVE-2015-4024
    - fix various functions accept paths with NUL character       CVE-2015-4025, CVE-2015-4026, #1213407
    - ftp: fix integer overflow leading to heap overflow when       reading FTP file listing CVE-2015-4022
    - phar: fix buffer over-read in metadata parsing CVE-2015-2783
    - phar: invalid pointer free() in phar_tar_process_metadata()       CVE-2015-3307
    - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
    - phar: fix memory corruption in phar_parse_tarfile caused by       empty entry file name CVE-2015-4021
    - apache2handler: fix pipelined request executed in deinitialized       interpreter under httpd 2.4 CVE-2015-3330
    - core: use after free vulnerability in unserialize()       CVE-2014-8142 and CVE-2015-0231
    - core: fix use-after-free in unserialize CVE-2015-2787
    - core: fix NUL byte injection in file name argument of       move_uploaded_file() CVE-2015-2348
    - date: use after free vulnerability in unserialize CVE-2015-0273
    - enchant: fix heap buffer overflow in enchant_broker_request_dict       CVE-2014-9705
    - exif: free called on unitialized pointer CVE-2015-0232
    - fileinfo: fix out of bounds read in mconvert CVE-2014-9652
    - gd: fix buffer read overflow in gd_gif_in.c CVE-2014-9709
    - phar: use after free in phar_object.c CVE-2015-2301
    - fileinfo: fix out-of-bounds read in elf note headers. CVE-2014-3710
    - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
    - core: fix integer overflow in unserialize() CVE-2014-3669
    - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670
    - gd: fix NULL pointer dereference in gdImageCreateFromXpm().
      CVE-2014-2497
    - gd: fix NUL byte injection in file names. CVE-2014-5120
    - fileinfo: fix extensive backtracking in regular expression       (incomplete fix for CVE-2013-7345). CVE-2014-3538
    - fileinfo: fix mconvert incorrect handling of truncated       pascal string size. CVE-2014-3478
    - fileinfo: fix cdf_read_property_info       (incomplete fix for CVE-2012-1571). CVE-2014-3587
    - spl: fix use-after-free in ArrayIterator due to object       change during sorting. CVE-2014-4698
    - spl: fix use-after-free in SPL Iterators. CVE-2014-4670
    - network: fix segfault in dns_get_record       (incomplete fix for CVE-2014-4049). CVE-2014-3597

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 5.4.x earlier than 5.4.40, 5.5.x earlier than 5.5.24, or 5.6.x earlier than 5.6.8 are exposed to the following issues :

  - An out-of-bounds read overflow error exists in the function 'GetCode_()' in file 'gd_gif_in.c' that allows denial of service attacks or disclosure of memory contents. (CVE-2014-9709)
  - A use-after-free error exists in the OPcache extension in the '_zend_shared_memdup()' function within the file 'zend_shared_alloc.c'. A remote attacker can exploit this to cause a denial of service or possibly have other unspecified impact. (CVE-2015-1351)
  - The function 'build_tablename()' in file 'pgsql.c' in the PostgreSQL extension does not properly validate token extraction for table names. A remote attacker, using a crafted name, can exploit this to cause a NULL pointer deference, leading to a denial of service. (CVE-2015-1352)
  - A use-after-free error exists in the function 'phar_rename_archive()' in file 'phar_object.c'. A remote attacker, by attempting to rename a phar archive to an already existing file name, can exploit this to cause a denial of service. (CVE-2015-2301)
  - A buffer read overflow error exists in the Phar component due to user-supplied input not being validated properly when handling phar parsing during 'unserialize()' function calls. An attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-2783)
  - A buffer overflow flaw exists in the 'phar_set_inode()' function in file 'phar_internal.h' when handling archive files, such as tar, zip, or phar files. A remote attacker can exploit this to execute arbitrary code or cause a denial of service. (CVE-2015-3329)
  - A flaw exists in the Apache2handler SAPI component, when handling pipelined HTTP requests, that a remote attacker can exploit to execute arbitrary code. (CVE-2015-3330)
  - An information disclosure vulnerability exists because of a type confusion error. Specifically, this issue occurs when the 'unserialize()' function is used with SoapFault object's '__toString()' function. An attacker can exploit this issue to leak arbitrary memory blocks.
  - A flaw exists in the 'phar_parse_metadata()' function in 'ext/phar/phar.c'. The issue is triggered as user-supplied input is not properly validated when parsing a specially crafted TAR file. This may allow a remote attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2015-3307)
  - A type confusion flaw exists in the '__toString()' method in 'incomplete_class.c' that may allow a context-dependent attacker to leak arbitrary memory blocks or potentially cause a denial of service. (CVE-2015-4602)
  - Multiple unspecified issues exist in '/soap/php_http.c' and '/soap/php_encoding.c'. This may allow an attacker to have an unspecified impact. (CVE-2015-4601)
  - A denial of service vulnerability affects Fine Free File, a common component used in PHP known as 'file'. Specifically, this issue affects the source file 'libmagic/softmagic.c' because it fails to properly handle offsets that exceed 'bytecnt' or vice versa. (CVE-2015-4605)

According to its banner, the version of PHP 5.6.x running on the remote web server is prior to 5.6.8. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.5.x running on the remote web server is prior to 5.5.24. It is, therefore, affected by multiple vulnerabilities :

  - An unspecified use-after-free error exists in the
    _zend_shared_memdup() function within file     ext/opcache/zend_shared_alloc.c that allows an     unauthenticated, remote attacker to have an unspecified     impact. (CVE-2015-1351)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A flaw exists in the ZEND_VM_HELPER_EX() function within     file /Zend/zend_vm_def.h when handling a __get()     function call. An unauthenticated, remote attacker can     exploit this to cause a cause a denial of service     condition.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the SPL component,     specifically in the spl_object_storage_get_gc() function     within file ext/spl/spl_observer.c. An unauthenticated,     remote attacker can exploit this to execute arbitrary     code.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of PHP 5.4.x running on the remote web server is prior to 5.4.40. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the GetCode_()     function within file gd_gif_in.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2014-9709)

  - A NULL pointer dereference flaw exists in the     build_tablename() function within file pgsql.c in the     PostgreSQL extension due to a failure to validate token     extraction for table names. An authenticated, remote     attacker can exploit this, via a crafted name, to cause     a denial of service condition. (CVE-2015-1352)

  - A use-after-free error exists in the     phar_rename_archive() function within file     phar_object.c. An unauthenticated, remote attacker can     exploit this, by attempting to rename a phar archive to     an already existing file name, to cause a denial of     service condition. (CVE-2015-2301)

  - An out-of-bounds read error exists in the Phar component     due to improper validation of user-supplied input when     handling phar parsing during unserialize() function     calls. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     disclosure of memory contents. (CVE-2015-2783)

  - A memory corruption issue exists in the     phar_parse_metadata() function in file ext/phar/phar.c     due to improper validation of user-supplied input when     parsing a specially crafted TAR archive. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2015-3307)

  - Multiple stack-based buffer overflow conditions exist in     the phar_set_inode() function in file phar_internal.h     when handling archive files, such as tar, zip, or phar     files. An unauthenticated, remote attacker can exploit     these to cause a denial of service condition or the     execution or arbitrary code. (CVE-2015-3329)

  - A flaw exists in the Apache2handler SAPI component when     handling pipelined HTTP requests that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-3330)

  - A flaw exists in multiple functions due to a failure to     check for NULL byte (%00) sequences in a path when     processing or reading a file. An unauthenticated, remote     attacker can exploit this, via specially crafted input     to an application calling those functions, to bypass     intended restrictions and disclose potentially     sensitive information. (CVE-2015-3411, CVE-2015-3412)

  - A type confusion error exists in multiple functions     within file ext/soap/soap.c that is triggered when     calling unserialize(). An unauthenticated, remote     attacker can exploit this to disclose memory contents,     cause a denial of service condition, or execute     arbitrary code. (CVE-2015-4599, CVE-2015-4600)

  - Multiple type confusion errors exist within files     ext/soap/php_encoding.c, ext/soap/php_http.c, and     ext/soap/soap.c that allow an unauthenticated, remote     attacker to cause a denial of service condition or the     execution of arbitrary code. (CVE-2015-4601)

  - A type confusion error exists in the
    __PHP_Incomplete_Class() function within file     ext/standard/incomplete_class.c that allows an     unauthenticated, remote attacker to cause a denial of     service condition or the execution of arbitrary code.
    (CVE-2015-4602)

  - A type confusion error exists in the     exception::getTraceAsString() function within file     Zend/zend_exceptions.c that allows a remote attacker to     execute arbitrary code. (CVE-2015-4603)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mget() function within file softmagic.c. The function     fails to maintain a certain pointer relationship. An     unauthenticated, remote attacker can exploit this, via a     crafted string, to crash the application.
    (CVE-2015-4604)

  - A denial of service vulnerability exists due to a flaw     in the bundled libmagic library, specifically in the     mcopy() function within file softmagic.c. The function     fails to properly handle an offset that exceeds     'bytecnt'. An unauthenticated, remote attacker can     exploit this, via a crafted string, to crash the     application. (CVE-2015-4605)

  - A use-after-free error exists in the sqlite3_close()     function within file /ext/sqlite3/sqlite3.c when closing     database connections. An unauthenticated, remote     attacker can exploit this to execute arbitrary code.

  - A type confusion error exists in the     php_stream_url_wrap_http_ex() function within file     ext/standard/http_fopen_wrapper.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A use-after-free error exists in the php_curl() function     within file ext/curl/interface.c that allows an     unauthenticated, remote attacker to execute arbitrary     code.

  - A NULL pointer dereference flaw exists within file     /ext/ereg/regex/regcomp.c that allows an     unauthenticated, remote attacker attacker to cause a     denial of service condition.

Note that Nessus has not attempted to exploit these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
289255	MiracleLinux 4 : php-5.3.3-46.AXS4 (AXSA:2015-184:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
289176	MiracleLinux 7 : rh-php56-php-5.6.5-7.el7 (AXSA:2016-130:01)	Nessus	Miracle Linux Local Security Checks	Local	critical
218802	Linux Distros Unpatched Vulnerability : CVE-2015-3307	Nessus	Misc.	Local	critical
193682	RHEL 6 / 7 : php54 (RHSA-2015:1066)	Nessus	Red Hat Local Security Checks	Local	critical
181083	Oracle Linux 7 : php55-php (ELSA-2015-1186)	Nessus	Oracle Linux Local Security Checks	Local	critical
181066	Oracle Linux 6 / 7 : php54 (ELSA-2015-1066)	Nessus	Oracle Linux Local Security Checks	Local	critical
124998	EulerOS Virtualization 3.0.1.0 : php (EulerOS-SA-2019-1545)	Nessus	Huawei Local Security Checks	Local	critical
98831	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		high
85808	Debian DLA-307-1 : php5 security update	Nessus	Debian Local Security Checks	Local	critical
85409	Mac OS X Multiple Vulnerabilities (Security Update 2015-006)	Nessus	MacOS X Local Security Checks	Local	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	high
84661	Scientific Linux Security Update : php on SL6.x i386/x86_64 (20150709)	Nessus	Scientific Linux Local Security Checks	Local	critical
84660	RHEL 6 : php (RHSA-2015:1218)	Nessus	Red Hat Local Security Checks	Local	critical
84659	Oracle Linux 6 : php (ELSA-2015-1218)	Nessus	Oracle Linux Local Security Checks	Local	critical
84648	CentOS 6 : php (CESA-2015:1218)	Nessus	CentOS Local Security Checks	Local	critical
84394	Scientific Linux Security Update : php on SL7.x x86_64 (20150623)	Nessus	Scientific Linux Local Security Checks	Local	critical
84355	RHEL 7 : php (RHSA-2015:1135)	Nessus	Red Hat Local Security Checks	Local	critical
84351	Oracle Linux 7 : php (ELSA-2015-1135)	Nessus	Oracle Linux Local Security Checks	Local	critical
84345	CentOS 7 : php (CESA-2015:1135)	Nessus	CentOS Local Security Checks	Local	critical
8784	PHP 5.4.x < 5.4.40 / 5.5.x < 5.5.24 / 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		critical
83035	PHP 5.6.x < 5.6.8 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical
83034	PHP 5.5.x < 5.5.24 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical
83033	PHP 5.4.x < 5.4.40 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2015-3307

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

high

critical

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical