Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.1. It is, therefore, affected by multiple vulnerabilities :

- A use-after-free error exists in the collator_sort_with_sort_keys() function due to improper clearing of pointers when destroying an array. An unauthenticated, remote attacker can exploit this to dereference already freed memory, resulting in the execution of arbitrary code. (CVE-2015-8616)

- A format string flaw exists in the zend_throw_or_error() function due to improper sanitization of format string specifiers (e.g. %s and %x) in user-supplied input. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2015-8617)

- A flaw exists in the php_password_make_salt() function due to a fall back to password salt generation in an insecure manner when attempts to read random bytes from the operating system's cryptographically secure pseudo-random number generator (CSPRING) fail. An attacker can exploit this to more easily predict the generated password salt.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PHP 7.0.x prior to 7.0.1 are vulnerable to the following issues :

 - A use-after-free error exists in the 'collator_sort_with_sort_keys()' function in 'xt/intl/collator/collator_sort.c.'  The issue is triggered as pointers are not properly cleared when destroying an array. This may allow a remote attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2015-8616)
 - A format string flaw exists in the 'zend_throw_or_error()' function in 'Zend/zend_execute_API.c' as format string specifiers (e.g. %s and %x) are not properly sanitized in user-supplied input such as when handling non-existent class names.  This may allow an authenticated, remote attacker to potentially execute arbitrary code. (CVE-2015-8617)
 - A flaw exists in the 'php_password_make_salt()' function in 'ext/standard/password.c' that is triggered when attempts to read random bytes from the operating system's cryptographically secure pseudo-random number generator (CSPRNG) fail.  In such cases, the function falls back to generating the password salt in an insecure manner.  This may allow an attacker to more easily predict the generated password salt.

According to its banner, the version of PHP running on the remote web server is 7.0.x prior to 7.0.1. It is, therefore, affected by multiple vulnerabilities :

  - A use-after-free error exists in the     collator_sort_with_sort_keys() function due to improper     clearing of pointers when destroying an array. An     unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2015-8616)

  - A format string flaw exists in the zend_throw_or_error()     function due to improper sanitization of format string     specifiers (e.g. %s and %x) in user-supplied input. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2015-8617)

  - A flaw exists in the php_password_make_salt() function     due to a fall back to password salt generation in an     insecure manner when attempts to read random bytes from     the operating system's cryptographically secure     pseudo-random number generator (CSPRING) fail. An     attacker can exploit this to more easily predict the     generated password salt.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
98833	PHP 7.0.x < 7.0.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
9064	PHP 7.0.x < 7.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers		critical
87599	PHP 7.0.x < 7.0.1 Multiple Vulnerabilities	Nessus	CGI abuses	Remote	critical

Detections

Analytics

CVE-2015-8616

high

Tenable Plugins

critical

critical

critical