Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php7 fixes the following security issues :

  - CVE-2016-7480: The SplObjectStorage unserialize     implementation in ext/spl/spl_observer.c in PHP did not     verify that a key is an object, which allowed remote     attackers to execute arbitrary code or cause a denial of     service (uninitialized memory access) via crafted     serialized data. (bsc#1019568)

  - CVE-2017-5340: Zend/zend_hash.c in PHP mishandled     certain cases that require large array allocations,     which allowed remote attackers to execute arbitrary code     or cause a denial of service (integer overflow,     uninitialized memory access, and use of arbitrary     destructor function pointers) via crafted serialized     data. (bsc#1019570)

  - CVE-2016-7479: In all versions of PHP 7, during the     unserialization process, resizing the 'properties' hash     table of a serialized object may have lead to     use-after-free. A remote attacker may exploit this bug     to gain arbitrary code execution. (bsc#1019547)

  - CVE-2016-7478: Zend/zend_exceptions.c in PHP allowed     remote attackers to cause a denial of service (infinite     loop) via a crafted Exception object in serialized data,     a related issue to CVE-2015-8876. (bsc#1019550)

  - CVE-2016-10159: Integer overflow in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory consumption or application crash) via a     truncated manifest entry in a PHAR archive.
    (bsc#1022255)

  - CVE-2016-10160: Off-by-one error in the     phar_parse_pharfile function in ext/phar/phar.c in PHP     allowed remote attackers to cause a denial of service     (memory corruption) or possibly execute arbitrary code     via a crafted PHAR archive with an alias mismatch.
    (bsc#1022257)

  - CVE-2016-10161: The object_common1 function in     ext/standard/var_unserializer.c in PHP allowed remote     attackers to cause a denial of service (buffer over-read     and application crash) via crafted serialized data that     is mishandled in a finish_nested_data call.
    (bsc#1022260)

  - CVE-2016-10162: The php_wddx_pop_element function in     ext/wddx/wddx.c in PHP 7 allowed remote attackers to     cause a denial of service (NULL pointer dereference and     application crash) via an inapplicable class name in a     wddxPacket XML document, leading to mishandling in a     wddx_deserialize call. (bsc#1022262)

  - CVE-2016-10166: A potential unsigned underflow in gd     interpolation functions could lead to memory corruption     in the PHP gd module (bsc#1022263)

  - CVE-2016-10167: A denial of service problem in     gdImageCreateFromGd2Ctx() could lead to php out of     memory even on small files. (bsc#1022264)

  - CVE-2016-10168: A signed integer overflow in the gd     module could lead to memory corruption (bsc#1022265)

  - CVE-2016-9138: PHP mishandled property modification     during __wakeup processing, which allows remote     attackers to cause a denial of service or possibly have     unspecified other impact via crafted serialized data, as     demonstrated by Exception::__toString with     DateInterval::__wakeup. (bsc#1008026)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php5 fixes the following issues :

  - CVE-2013-7456: imagescale out-of-bounds read     (bnc#982009).

  - CVE-2016-5093: get_icu_value_internal out-of-bounds read     (bnc#982010).

  - CVE-2016-5094: Don't create strings with lengths outside     of valid range (bnc#982011).

  - CVE-2016-5095: Don't create strings with lengths outside     of valid range (bnc#982012).

  - CVE-2016-5096: int/size_t confusion in fread     (bsc#982013).

  - CVE-2015-8877: The gdImageScaleTwoPass function in     gd_interpolation.c in the GD Graphics Library (aka     libgd) as used in PHP used inconsistent allocate and     free approaches, which allowed remote attackers to cause     a denial of service (memory consumption) via a crafted     call, as demonstrated by a call to the PHP imagescale     function (bsc#981061).

  - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not     validate certain Exception objects, which allowed remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) or trigger unintended     method execution via crafted serialized data     (bsc#981049).

  - CVE-2015-8879: The odbc_bindcols function in     ext/odbc/php_odbc.c in PHP mishandles driver behavior     for SQL_WVARCHAR columns, which allowed remote attackers     to cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table (bsc#981050).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3045-1 advisory.

    It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-4116)

    It was discovered that PHP incorrectly handled recursive method calls. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS     and Ubuntu 14.04 LTS. (CVE-2015-8873)

    It was discovered that PHP incorrectly validated certain Exception objects when unserializing data. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8876)

    It was discovered that PHP header() function performed insufficient filtering for Internet Explorer. A     remote attacker could possibly use this issue to perform a XSS attack. This issue only affected Ubuntu     12.04 LTS and Ubuntu 14.04 LTS. (CVE-2015-8935)

    It was discovered that PHP incorrectly handled certain locale operations. An attacker could use this issue     to cause PHP to crash, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS and     Ubuntu 14.04 LTS. (CVE-2016-5093)

    It was discovered that the PHP php_html_entities() function incorrectly handled certain string lengths. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5094,     CVE-2016-5095)

    It was discovered that the PHP fread() function incorrectly handled certain lengths. An attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5096)

    It was discovered that the PHP FastCGI Process Manager (FPM) SAPI incorrectly handled memory in the access     logging feature. An attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly expose sensitive information. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2016-5114)

    It was discovered that PHP would not protect applications from contents of the HTTP_PROXY environment     variable when based on the contents of the Proxy header from HTTP requests. A remote attacker could     possibly use this issue in combination with scripts that honour the HTTP_PROXY variable to redirect     outgoing HTTP requests. (CVE-2016-5385)

    Hans Jerry Illikainen discovered that the PHP bzread() function incorrectly performed error handling. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2016-5399)

    It was discovered that certain PHP multibyte string functions incorrectly handled memory. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2016-5768)

    It was discovered that the PHP Mcrypt extension incorrectly handled memory. A remote attacker could use     this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5769)

    It was discovered that the PHP garbage collector incorrectly handled certain objects when unserializing     malicious data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of     service, or possibly execute arbitrary code. This issue was only addressed in Ubuntu Ubuntu 14.04 LTS.
    (CVE-2016-5771, CVE-2016-5773)

    It was discovered that PHP incorrectly handled memory when unserializing malicious xml data. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-5772)

    It was discovered that the PHP php_url_parse_ex() function incorrectly handled string termination. A     remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-6288)

    It was discovered that PHP incorrectly handled path lengths when extracting certain Zip archives. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6289)

    It was discovered that PHP incorrectly handled session deserialization. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-6290)

    It was discovered that PHP incorrectly handled exif headers when processing certain JPEG images. A remote     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6291, CVE-2016-6292)

    It was discovered that PHP incorrectly handled certain locale operations. A remote attacker could use this     issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2016-6294)

    It was discovered that the PHP garbage collector incorrectly handled certain objects when unserializing     SNMP data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service,     or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
    (CVE-2016-6295)

    It was discovered that the PHP xmlrpc_encode_request() function incorrectly handled certain lengths. An     attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6296)

    It was discovered that the PHP php_stream_zip_opener() function incorrectly handled memory. An attacker     could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2016-6297)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for php5 fixes the following issues :

  - CVE-2013-7456: imagescale out-of-bounds read     (bnc#982009).

  - CVE-2016-5093: get_icu_value_internal out-of-bounds read     (bnc#982010).

  - CVE-2016-5094: Don't create strings with lengths outside     of valid range (bnc#982011).

  - CVE-2016-5095: Don't create strings with lengths outside     of valid range (bnc#982012).

  - CVE-2016-5096: int/size_t confusion in fread     (bsc#982013).

  - CVE-2015-8877: The gdImageScaleTwoPass function in     gd_interpolation.c in the GD Graphics Library (aka     libgd) as used in PHP used inconsistent allocate and     free approaches, which allowed remote attackers to cause     a denial of service (memory consumption) via a crafted     call, as demonstrated by a call to the PHP imagescale     function (bsc#981061).

  - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not     validate certain Exception objects, which allowed remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) or trigger unintended     method execution via crafted serialized data     (bsc#981049).

  - CVE-2015-8879: The odbc_bindcols function in     ext/odbc/php_odbc.c in PHP mishandles driver behavior     for SQL_WVARCHAR columns, which allowed remote attackers     to cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table (bsc#981050).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php5 fixes the following issues :

  - CVE-2013-7456: imagescale out-of-bounds read     (bnc#982009).

  - CVE-2016-5093: get_icu_value_internal out-of-bounds read     (bnc#982010).

  - CVE-2016-5094: Don't create strings with lengths outside     int range (bnc#982011).

  - CVE-2016-5095: Don't create strings with lengths outside     int range (bnc#982012).

  - CVE-2016-5096: int/size_t confusion in fread     (bsc#982013).

  - CVE-2016-5114: fpm_log.c memory leak and buffer overflow     (bnc#982162).

  - CVE-2015-8877: The gdImageScaleTwoPass function in     gd_interpolation.c in the GD Graphics Library (aka     libgd), as used in PHP, used inconsistent allocate and     free approaches, which allowed remote attackers to cause     a denial of service (memory consumption) via a crafted     call, as demonstrated by a call to the PHP imagescale     function (bsc#981061).

  - CVE-2015-8876: Zend/zend_exceptions.c in PHP did not     validate certain Exception objects, which allowed remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) or trigger unintended     method execution via crafted serialized data     (bsc#981049).

  - CVE-2015-8879: The odbc_bindcols function in     ext/odbc/php_odbc.c in PHP mishandled driver behavior     for SQL_WVARCHAR columns, which allowed remote attackers     to cause a denial of service (application crash) in     opportunistic circumstances by leveraging use of the     odbc_fetch_array function to access a certain type of     Microsoft SQL Server table Aliased: (bsc#981050).

  - CVE-2015-4116: Use-after-free vulnerability in the     spl_ptr_heap_insert function in ext/spl/spl_heap.c in     PHP allowed remote attackers to execute arbitrary code     by triggering a failed SplMinHeap::compare operation     (bsc#980366).

  - CVE-2015-8874: Stack consumption vulnerability in GD in     PHP allowed remote attackers to cause a denial of     service via a crafted imagefilltoborder call     (bsc#980375).

  - CVE-2015-8873: Stack consumption vulnerability in     Zend/zend_exceptions.c in PHP allowed remote attackers     to cause a denial of service (segmentation fault) via     recursive method calls (bsc#980373).

  - CVE-2016-3074: Integer signedness error in GD Graphics     Library (aka libgd or libgd2) allowed remote attackers     to cause a denial of service (crash) or potentially     execute arbitrary code via crafted compressed gd2 data,     which triggers a heap-based buffer overflow     (bsc#976775).

According to its banner, the version of PHP running on the remote web server is 5.5.x prior to 5.5.28. It is, therefore, affected by multiple vulnerabilities :

  - Multiple use-after-free errors exist in spl_array.c,     spl_observer.c, and spl_dllist.c due to improper     sanitization of input to the unserialize() function. An     attacker can exploit these issues, by using a specially     crafted SplDoublyLinkedList, SplArrayObject, or     SplObjectStorage object, to deference freed memory and     thus execute arbitrary code. (CVE-2015-6831)

  - A dangling pointer error exists in file spl_array.c due     to improper sanitization of input to the unserialize()     function. An attacker can exploit this, by using a     specially crafted SplDoublyLinkedList object, to gain     control over a deallocated pointer and thus execute     arbitrary code. (CVE-2015-6832)

  - A path traversal flaw exists in file phar_object.c due     to improper sanitization of user-supplied input. An     attacker can exploit this to write arbitrary files.
    (CVE-2015-6833)

  - A type confusion flaw exists in the     serialize_function_call() function in soap.c due to     improper validation of input passed via the header     field. A remote attacker can exploit this to execute     arbitrary code. (CVE-2015-6836)

  - Multiple type confusion flaws exist in the _call()     method in file php_http.c when handling calls for     zend_hash_get_current_key or 'Z*'. An attacker can     exploit this to disclose memory contents or crash     an application using PHP. (CVE-2015-8835)

  - The openssl_random_pseudo_bytes() function in file     openssl.c does not generate sufficiently random numbers.
    This allows an attacker to more easily predict the     results, thus allowing further attacks to be carried     out. (CVE-2015-8867)

  - A flaw exists in file zend_exceptions.c due to the     improper use of the function unserialize() during     recursive method calls. A remote attacker can exploit     this to crash an application using PHP. (CVE-2015-8873)

  - A flaw exists in file zend_exceptions.c due to     insufficient type checking by functions unserialize()     and __toString(). A remote attacker can exploit this to     cause a NULL pointer deference or unexpected method     execution, thus causing an application using PHP to     crash. (CVE-2015-8876)

  - An integer truncation flaw exists in the     zend_hash_compare() function in zend_hash.c that is     triggered when comparing arrays. A remote attacker can     exploit this to cause arrays to be improperly matched     during comparison.
    Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
119993	SUSE SLES12 Security Update : php7 (SUSE-SU-2017:0534-1)	Nessus	SuSE Local Security Checks	critical
97563	openSUSE Security Update : php7 (openSUSE-2017-304)	Nessus	SuSE Local Security Checks	critical
93160	SUSE SLED12 / SLES12 Security Update : php5 (SUSE-SU-2016:1633-1)	Nessus	SuSE Local Security Checks	critical
92699	Ubuntu 14.04 LTS / 16.04 LTS : PHP vulnerabilities (USN-3045-1)	Nessus	Ubuntu Local Security Checks	critical
91869	openSUSE Security Update : php5 (openSUSE-2016-776)	Nessus	SuSE Local Security Checks	critical
91585	openSUSE Security Update : php5 (openSUSE-2016-703)	Nessus	SuSE Local Security Checks	critical
85299	PHP 5.5.x < 5.5.28 Multiple Vulnerabilities	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2015-8876

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical