http://git.php.net/?p=php-src.git;a=commit;h=0e6fe3a4c96be2d3e88389a5776f878021b4c59f

DSA-3698

[oss-security] 20161101 Re: CVE assignment for PHP 5.6.27 and 7.0.12

http://www.php.net/ChangeLog-5.php

http://www.php.net/ChangeLog-7.php

93577

https://bugs.php.net/bug.php?id=73147

https://www.tenable.com/security/tns-2016-19

This update for php7 fixes the following security issues :

  - CVE-2016-5385: Setting HTTP_PROXY environment variable     via Proxy header (httpoxy) (bsc#988486).

  - CVE-2016-9137: Fixing a Use After Free in unserialize()     (bsc#1008029).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Tenable SecurityCenter application installed on the remote host is missing a security patch. It is, therefore, affected by multiple vulnerabilities in the bundled version of PHP :

  - A use-after-free error exists in the unserialize()     function that allows an unauthenticated, remote attacker     to dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-9137)

  - A NULL pointer dereference flaw exists in the     SimpleXMLElement::asXML() function within file     ext/simplexml/simplexml.c. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - A heap-based buffer overflow condition exists in the     php_ereg_replace() function within file ext/ereg/ereg.c     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code.

  - A flaw exists in the openssl_random_pseudo_bytes()     function within file ext/openssl/openssl.c when handling     strings larger than 2GB. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - A flaw exists in the openssl_encrypt() function within     file ext/openssl/openssl.c when handling strings larger     than 2GB. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.

  - An integer overflow condition exists in the     imap_8bit() function within file ext/imap/php_imap.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code.

  - A flaw exists in the _bc_new_num_ex() function within     file ext/bcmath/libbcmath/src/init.c when handling     values passed via the 'scale' parameter. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - A flaw exists in the php_resolve_path() function within     file main/fopen_wrappers.c when handling negative size     values passed via the 'filename' parameter. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - A flaw exists in the dom_document_save_html() function     within file ext/dom/document.c due to missing NULL     checks. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition.

  - An integer overflow condition exists in the     mb_encode_*() functions in file ext/mbstring/mbstring.c     due to improper validation of the length of encoded     data. An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code.

  - A NULL pointer dereference flaw exists in the     CachingIterator() function within file     ext/spl/spl_iterators.c when handling string     conversions. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.

  - An integer overflow condition exists in the     number_format() function within file ext/standard/math.c     when handling 'decimals' and 'dec_point' parameters that     have values that are equal or close to 0x7fffffff. An     unauthenticated, remote attacker can exploit this to     cause a heap buffer overflow, resulting in a denial of     service condition or the execution of arbitrary code.

  - A stack-based overflow condition exists in the     ResourceBundle::create and ResourceBundle::getLocales     methods and their respective functions within file     ext/intl/resourcebundle/resourcebundle_class.c due to     improper validation of input passed via the 'bundlename'     parameter. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution or arbitrary code.

  - An integer overflow condition exists in the     php_pcre_replace_impl() function within file     ext/pcre/php_pcre.c due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this to cause a heap-based buffer overflow,     resulting in a denial of service condition or the     execution of arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

USN-3211-1 fixed vulnerabilities in PHP by updating to the new 7.0.15 upstream release. PHP 7.0.15 introduced a regression when using MySQL with large blobs. This update fixes the problem with a backported fix.

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9935)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-9936)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10162)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2017-5340).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9936)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10162)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5340).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that PHP incorrectly handled certain arguments to the locale_get_display_name function. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9912)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to hang, resulting in a denial of service. (CVE-2016-7478)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7479)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS.
(CVE-2016-9137)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-9934)

It was discovered that PHP incorrectly handled unserializing certain wddxPacket XML documents. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-9935)

It was discovered that PHP incorrectly handled certain EXIF data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10158)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash or consume resources, resulting in a denial of service. (CVE-2016-10159)

It was discovered that PHP incorrectly handled certain PHAR archives.
A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2016-10160)

It was discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2016-10161).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is prior to 5.4.1. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

  - A cross-site scripting (XSS) vulnerability exists within     the JQuery UI dialog() function due to improper     validation of input to the 'closeText' parameter before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2016-7103)

  - A denial of service vulnerability exists in PHP within     file ext/standard/var_unserializer.c due to improper     handling of certain invalid objects. An unauthenticated,     remote attacker can exploit this, via specially crafted     serialized data that leads to a __destruct() or magic()     function call, to cause a denial of service condition or     potentially execute arbitrary code. (CVE-2016-7124)

  - A flaw exists in PHP in file ext/session/session.c when     handling session names. An unauthenticated, remote     attacker can exploit this to inject arbitrary data into     sessions. (CVE-2016-7125)

  - An integer truncation error exists in PHP in the     select_colors() function in file ext/gd/libgd/gd_topal.c     when handling the number of colors. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in the execution of arbitrary     code. (CVE-2016-7126)

  - An array-indexing error exists in PHP in the     imagegammacorrect() function within file ext/gd/gd.c     when handling negative gamma values. An unauthenticated,     remote attacker can exploit this, by writing a NULL to     an arbitrary memory location, to cause a crash or the     execution of arbitrary code. (CVE-2016-7127)

  - A flaw exists in PHP in the exif_process_IFD_in_TIFF()     function within file ext/exif/exif.c when handling TIFF     image content. An unauthenticated, remote attacker can     exploit this to disclose memory contents.
    (CVE-2016-7128)

  - A denial of service vulnerability exists in PHP in the     php_wddx_process_data() function within file     ext/wddx/wddx.c when deserializing invalid dateTime     values. An unauthenticated, remote attacker can exploit     this to cause a crash. (CVE-2016-7129)

  - A NULL pointer dereference flaw exists in PHP in the     php_wddx_pop_element() function within file     ext/wddx/wddx.c when handling Base64 binary values. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-7130)

  - A NULL pointer dereference flaw exists in PHP in the     php_wddx_deserialize_ex() function within file     ext/wddx/wddx.c when handling invalid XML content. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-7131)

  - A NULL pointer dereference flaw exists in PHP in the     php_wddx_pop_element() function within file     ext/wddx/wddx.c. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.
    (CVE-2016-7132)

  - A buffer overflow condition exists in PHP in file     ext/mysqlnd/mysqlnd_wireprotocol.c within the     php_mysqlnd_rowp_read_text_protocol_aux() function when     handling the BIT field. An unauthenticated, remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a crash or the execution of     arbitrary code. (CVE-2016-7412)

  - A use-after-free error exists in PHP in the     wddx_stack_destroy() function within file     ext/wddx/wddx.c when deserializing recordset elements.
    An unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2016-7413)

  - An out-of-bounds access error exists in PHP in the     phar_parse_zipfile() function within file ext/phar/zip.c     when handling the uncompressed file size. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact. (CVE-2016-7414)

  - Multiple stack-based buffer overflow conditions exist in     the International Components for Unicode for C/C++     (ICU4C) component in the msgfmt_format_message()     function within file common/locid.cpp when handling     locale strings. An unauthenticated, remote attacker can     exploit these, via a long locale string, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-7415, CVE-2016-7416)

  - A flaw exists in PHP within file ext/spl/spl_array.c,     specifically in the spl_array_get_dimension_ptr_ptr()     function during the deserialization of SplArray, due to     improper validation of types. An unauthenticated, remote     attacker can exploit this to cause a crash or other     unspecified impact. (CVE-2016-7417)

  - An out-of-bounds read error exists in PHP in the     php_wddx_push_element() function within file     ext/wddx/wddx.c. An unauthenticated, remote attacker     can exploit this to cause a crash or the disclosure     of memory contents. (CVE-2016-7418)

  - A use-after-free error exists in PHP within the     unserialize() function in file ext/curl/curl_file.c. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2016-9137)

  - An integer overflow condition exists in PHP in the     php_snmp_parse_oid() function in file ext/snmp/snmp.c.
    An unauthenticated, remote attacker can exploit this to     cause a heap-based buffer overflow, resulting in the     execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     sql_regcase() function within file ext/ereg/ereg.c when     handling overly long strings. An unauthenticated, remote     attacker can exploit this to corrupt memory, resulting     in the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     php_base64_encode() function within file     ext/standard/base64.c when handling overly long     strings. An unauthenticated, remote attacker can exploit     this to corrupt memory, resulting in the execution of     arbitrary code.

  - An integer overflow condition exists in PHP in the     php_quot_print_encode() function within file     ext/standard/quot_print.c when handling overly long     strings. An unauthenticated, remote attacker can     exploit this to cause a heap-based buffer overflow,     resulting in the execution of arbitrary code.

  - A use-after-free error exists in PHP in the     unserialize() function within file ext/standard/var.c.
    An unauthenticated, remote attacker can exploit this to     dereference already freed memory, resulting in the     execution of arbitrary code.

  - A flaw exists in PHP in the php_ftp_fopen_connect()     function within file ext/standard/ftp_fopen_wrapper.c     due to silently downgrading to regular FTP even if a     secure method has been requested. A man-in-the-middle     (MitM) attacker can exploit this to downgrade the FTP     communication.

  - An integer overflow condition exists in PHP in the     php_url_encode() function within file ext/standard/url.c     when handling overly long strings. An unauthenticated,     remote attacker can exploit this to corrupt memory,     resulting in the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     php_uuencode() function in file ext/standard/uuencode.c.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code.

  - An integer overflow condition exists in PHP in the     bzdecompress() function within file ext/bz2/bz2.c. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code.

  - An integer overflow condition exists in PHP in the     curl_escape() function within file ext/curl/interface.c     when handling overly long escaped strings. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code.

  - An out-of-bounds access error exists in PHP in file     ext/phar/tar.c, specifically in the phar_parse_tarfile()     function during the verification of signatures. An     unauthenticated, remote attacker can exploit this to     have an unspecified impact.

  - A flaw exists in PHP when destroying deserialized     objects due to improper validation of certain     unspecified input. An unauthenticated, remote attacker     can exploit this to corrupt memory, resulting in a     denial of service condition or the execution of     arbitrary code.

  - An integer overflow condition exists in PHP within the     fgetcsv() function due to improper validation of CSV     field lengths. An unauthenticated, remote attacker can     exploit this to corrupt memory, resulting in a denial of     service condition or the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     wordwrap() function within file ext/standard/string.c     due to improper validation of certain unspecified input.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in a denial of service     condition or the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     fgets() function within file ext/standard/file.c due to     improper validation of certain unspecified input. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in a denial of service     condition or the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the     xml_utf8_encode() function within file ext/xml/xml.c due     to improper validation of certain unspecified input. An     unauthenticated, remote attacker can exploit this to     cause an unspecified impact.

  - A flaw exists in PHP in the exif_process_IFD_in_TIFF()     function within file ext/exif/exif.c when handling     uninitialized thumbnail data. An unauthenticated, remote     attacker can exploit this to disclose memory contents.

  - A flaw exists in PHP due to the parse_url() function     returning the incorrect host. An unauthenticated, remote     attacker can exploit this to bypass authentication or to     conduct open redirection and server-side request forgery     attacks, depending on how the function is implemented.

  - A NULL pointer dereference flaw exists in PHP in the     SimpleXMLElement::asXML() function within file     ext/simplexml/simplexml.c. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - An heap buffer overflow condition exists in PHP in the     php_ereg_replace() function within file ext/ereg/ereg.c     due to improper validation of certain unspecified input.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code.

  - A flaw exists in PHP in file ext/openssl/openssl.c     within the openssl_random_pseudo_bytes() function when     handling strings larger than 2GB. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition.

  - A flaw exists in PHP in the openssl_encrypt() function     within file ext/openssl/openssl.c when handling strings     larger than 2GB. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.

  - An integer overflow condition exists in PHP in the     imap_8bit() function within file ext/imap/php_imap.c due     to improper validation of certain unspecified input. An     unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in a denial of service     condition or the execution of arbitrary code.

  - A flaw exists in PHP in the _bc_new_num_ex() function     within file ext/bcmath/libbcmath/src/init.c when     handling values passed via the 'scale' parameter. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - A flaw exists in PHP in the php_resolve_path() function     within file main/fopen_wrappers.c when handling negative     size values passed via the 'filename' parameter. An     unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - A flaw exists in PHP in the dom_document_save_html()     function within file ext/dom/document.c due to missing     NULL checks. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition.

  - An integer overflow condition exists in PHP in the     mb_encode_*() function in file ext/mbstring/mbstring.c     due to improper validation of the length of encoded     data. An unauthenticated, remote attacker can exploit     this to corrupt memory, resulting in a denial of service     condition or the execution of arbitrary code.

  - A NULL pointer dereference flaw exists in PHP in the     CachingIterator() function within file     ext/spl/spl_iterators.c when handling string conversion.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition.

  - An integer overflow condition exists in PHP in the     number_format() function within file ext/standard/math.c     when handling 'decimals' and 'dec_point' parameters with     values equal or close to 0x7FFFFFFF. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.

  - A overflow condition exists in PHP within file     ext/intl/resourcebundle/resourcebundle_class.c,     specifically in functions ResourceBundle::create() and     ResourceBundle::getLocales(), due to improper validation     of input passed via the 'bundlename' parameter. An     unauthenticated, remote attacker can exploit this to     cause a stack-based buffer overflow, resulting in a     denial of service condition or the execution of     arbitrary code.

  - An integer overflow condition exists in PHP in the     php_pcre_replace_impl() function within file     ext/pcre/php_pcre.c due to improper validation of     certain unspecified input. An unauthenticated, remote     attacker can exploit this to cause a heap-based buffer     overflow, resulting in a denial of service condition or     the execution of arbitrary code.

  - An integer overflow condition exists in PHP in the
    _php_imap_mail() function in file ext/imap/php_imap.c     when handling overly long strings. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.

  - A flaw exists in PHP in the bzcompress() function when     handling overly long strings. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - An integer overflow condition exists in PHP in the     gdImageAALine() function within file ext/gd/libgd/gd.c     due to improper validation of line limit values.
    An unauthenticated, remote attacker can exploit this to     cause an out-of-bounds write or read, resulting in a     denial of service condition, the disclosure of memory     contents, or the execution of arbitrary code.

  - Multiple stored cross-site scripting (XSS)     vulnerabilities exist in unspecified scripts due to     improper validation of input before returning it to     users. An unauthenticated, remote attacker can exploit     these, via a specially crafted request, to execute     arbitrary script code in a user's browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data. (CVE-2016-7480)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. (CVE-2016-9137)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP 7.x before 7.0.13, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value. (CVE-2016-9933)

ext/wddx/wddx.c in PHP 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string. (CVE-2016-9934)

The php_wddx_push_element function in ext/wddx/wddx.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. (CVE-2016-9935)

The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data. This vulnerability exists because of an incomplete fix for CVE-2015-6834 . (CVE-2016-9936)

A vulnerability was found in gd. Integer underflow in a calculation in dynamicGetbuf() was incorrectly handled, leading in some circumstances to an out of bounds write through a very large argument to memcpy().
An attacker could create a crafted image that would lead to a crash or, potentially, code execution. (CVE-2016-8670)

Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing. (CVE-2016-9137)

Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in PHP before 5.6.28, allows remote attackers to cause a denial of service (segmentation violation) via a crafted imagefilltoborder call that triggers use of a negative color value. (CVE-2016-9933)

ext/wddx/wddx.c in PHP before 5.6.28 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a wddxPacket XML document, as demonstrated by a PDORow string.
(CVE-2016-9934)

The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) or possibly have unspecified other impact via an empty boolean element in a wddxPacket XML document. (CVE-2016-9935)

This update for php5 fixes the following issues :

  - CVE-2016-9137: Use After Free in unserialize()     (bsc#1008029)

  - CVE-2016-5773: ZipArchive class Use After Free     Vulnerability in PHP's GC (bsc#986247)

This update was imported from the SUSE:SLE-12:Update update project.

This update for php7 fixes the following security issues :

  - CVE-2016-5385: Setting HTTP_PROXY environment variable     via Proxy header (httpoxy) (bsc#988486).

  - CVE-2016-9137: Fixing a Use After Free in unserialize()     (bsc#1008029).

This update was imported from the SUSE:SLE-12:Update update project.

This update for php5 fixes the following issues :

  - CVE-2016-9137: Use After Free in unserialize()     (bsc#1008029)

  - CVE-2016-5773: ZipArchive class Use After Free     Vulnerability in PHP's GC (bsc#986247)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for php5 fixes the following issues :

  - CVE-2016-9137: Fixed a use after free in unserialize()     in curl file deserialization [boo#1008029]

Several vulnerabilities were found in PHP, a general-purpose scripting language commonly used for web application development.

The vulnerabilities are addressed by upgrading PHP to the new upstream version 5.6.27, which includes additional bug fixes. Please refer to the upstream changelog for more information :

 https://php.net/ChangeLog-5.php#5.6.27

ID	Name	Product	Family	Severity
119987	SUSE SLES12 Security Update : php7 (SUSE-SU-2016:2941-1) (httpoxy)	Nessus	SuSE Local Security Checks	high
101049	Tenable SecurityCenter PHP < 5.6.27 Multiple Vulnerabilities	Nessus	Misc.	critical
97521	Ubuntu 16.04 LTS / 16.10 : php7.0 regression (USN-3211-2)	Nessus	Ubuntu Local Security Checks	high
97384	Ubuntu 16.04 LTS / 16.10 : php7.0 vulnerabilities (USN-3211-1)	Nessus	Ubuntu Local Security Checks	high
97190	Ubuntu 12.04 LTS / 14.04 LTS : php5 vulnerabilities (USN-3196-1)	Nessus	Ubuntu Local Security Checks	high
96832	Tenable SecurityCenter < 5.4.1 Multiple Vulnerabilities (TNS-2016-19)	Nessus	Misc.	high
96806	Amazon Linux AMI : php70 (ALAS-2017-788)	Nessus	Amazon Linux Local Security Checks	high
96805	Amazon Linux AMI : php56 (ALAS-2017-787)	Nessus	Amazon Linux Local Security Checks	high
95755	openSUSE Security Update : php5 (openSUSE-2016-1449)	Nessus	SuSE Local Security Checks	high
95746	openSUSE Security Update : php7 (openSUSE-2016-1440) (httpoxy)	Nessus	SuSE Local Security Checks	high
95535	SUSE SLED12 / SLES12 Security Update : php5 (SUSE-SU-2016:2975-1)	Nessus	SuSE Local Security Checks	high
95040	openSUSE Security Update : php5 (openSUSE-2016-1338)	Nessus	SuSE Local Security Checks	high
94234	Debian DSA-3698-1 : php5 - security update	Nessus	Debian Local Security Checks	high

CVE-2016-9137

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Tenable Plugins